Caesars reportedly paid millions to stop hackers releasing its data | It’s the second Las Vegas casino group to be attacked this week.::Caesars Entertainment reportedly paid “tens of millions of dollars” to hackers who threatened to release company data.

  • ∟⊔⊤∦∣≶
    link
    fedilink
    English
    711 year ago

    If hackers are gonna extort, I definitely prefer it’s the casinos they’re extorting

  • @[email protected]
    link
    fedilink
    English
    371 year ago

    I wonder if this is a good decision - you have to be very afraid of the publication of this data to pay millions to blackmailers without being sure that they won’t be at your door again soon.

    • JJROKCZ
      link
      English
      421 year ago

      I work in the casino industry, our databases are full of ssns, addresses, emails, telephone numbers, birthdates, food/liquor/tobacco/vacation/entertainment preferences, players with lines of credit through us, people cash checks or get cash advances through their credit cards through us so we have that info, through our play history data you can infer habits of where someone is or isn’t at certain times, some casino companies are now offering “cashless/chip less” play which is an app on your phone hooked up to a bank account we set up for you and tie to Experian, etc etc etc

      Casinos are essentially banks now, we have fuckloads of secure information and the casino industry hires the cheapest fucktards it can find on purpose to keep profits high. It’s no wonder we’re being targeted, we’re damn juicy targets. Even if IT tries our hardest, we’re handcuffed by cheap management and flat stupid users that fail phishing tests left and right and write down passwords on notepads or excel sheets

      • @[email protected]
        link
        fedilink
        English
        31 year ago

        So it is because you guys invaded people’s privacy by having data you don’t even need to operate?

        Sounds like a sad excuse.

        • JJROKCZ
          link
          English
          1
          edit-2
          1 year ago

          Much of that we do need to satisfy our regulatory requirements or offer products/services to players. You don’t get to be a big casino company by throwing a bunch of standalone slot machines in a building and having no reward/points program.

      • @[email protected]
        link
        fedilink
        English
        21 year ago

        Sadly this will probably not change unless attacks become so frequent that paying the ransom is more expensive than hiring competent people and teaching them proper opsec.

        It’s bound to happen at some point, but I wouldn’t hold my breath.

        • JJROKCZ
          link
          English
          11 year ago

          Sadly we’ll never be able to reach proper IPsec to all staff, Kyle in marketing is ALWAYS going to fuck it up because he thinks he’s a big shot who makes great business moves by buying cheap casserole dishes to give to players as gifts. That numbnuts is going to click the obvious scam link every time thinking he just found a new deal

      • @[email protected]
        link
        fedilink
        English
        11 year ago

        Thanks for that Insight, the last time i was in Vegas was about twenty years ago and i honestly had no Idea why a slot machine has to be online.

        • JJROKCZ
          link
          English
          21 year ago

          We can’t offer player points (that can be used on free play or free food or free hotel stays) without them being online and tracking the level of play on your card

      • @Phoenix3875
        link
        English
        01 year ago

        User being phished doesn’t leak the company’s database though.

        • @[email protected]
          link
          fedilink
          English
          31 year ago

          I think “user” in this case means “employee”. Phishing is by far the most common point of entry.

        • JJROKCZ
          link
          English
          11 year ago

          It does if that user has rights to access those databases, that would be a non-zero number of marketing analysis, p&a, data scientists, IT staff who maintain that infrastructure, etc. The most dangerous one is a compromised IT admin account and from the looks of it that happened to MGM this week

    • @moneyinphx
      link
      English
      171 year ago

      It’s becoming the standard to just pay the ransom. Many large companies have a cybersecurity insurance policy anyways. Plus on the hackers side, they have a reputation to maintain. If word gets out that a specific group isn’t decrypting after payment, they will be less likely to get paid in the future.

      • @Earthwormjim91
        link
        English
        41 year ago

        This isn’t a crypto locker hack though where you can verify pretty immediately if they’re going to keep their word by them decrypting your data.

        In this case the hackers actually physically have the data and are threatening to make it public if you don’t pay.

        There’s no way to verify that they will never release it once you pay them. They could just sit on it for years after getting paid and then come back and say pay up again or they’ll release it.

        • @Potatos_are_not_friends
          link
          English
          11 year ago

          Which is kinda what’s happening now!

          And this is why you don’t negotiate with terrorists.

    • IninewCrow
      link
      fedilink
      English
      61 year ago

      It also makes you wonder WHO the hackers are.

      Are they a national group? A competitor? Another casino?

      Or

      A foreign government or a foreign entity … which begs the question … if it came to light that it was a hostile government … would it be classified as an act of provocation or even war?

      • @Earthwormjim91
        link
        English
        31 year ago

        For hacking a casino? A private business unrelated to any US domestic or foreign interests?

        Not a chance in hell it would be an act of war. Businesses get hacked by China, Russia, North Korea, and Iran all the time. Hell, China hacked the US Office of Personnel Management and stole the security clearance records for 22 million people in 2015 and even that wasn’t declared an act of war.

        If an adversarial government hacking the US military and stealing security clearance records isn’t an act of war, a bunch of rich mobsters having their casinos hacked sure as shit ain’t.

      • JJROKCZ
        link
        English
        11 year ago

        No one is going to war over a casino breach, now if they got Boeing or Lockheed or Raytheon and it’s proven to be the Russian state doing it then there’s a possibility but that would still be unprecedented to start a war over a cyber attack

    • @foggy
      link
      English
      41 year ago

      That, or are very sure that you have deep enough black market connections to shake the thieves down.

  • @Fedizen
    link
    English
    131 year ago

    Paying these ransoms should just be illegal.

        • @[email protected]
          link
          fedilink
          English
          21 year ago

          I don’t think it would stop them, but I guess it could be tried.

          If it’s important enough people would pay anyway (maybe in a more hidden way but nonetheless would pay).

          • @[email protected]
            link
            fedilink
            English
            31 year ago

            If they can’t get anything out of it, then they are just wasting their time with the chance of getting caught.

            They will stop soon enough.

              • @Fedizen
                link
                English
                21 year ago

                well I think we’re all in favor of opening rehabilitation clinics for rich corporations that decide to cut corners.