Cybersecurity Incident Forces Turning Stone Casinos to Go Cash-Only

Turning Stone Resort Casino and two other associated tribal gaming properties in upstate New York are restricting transactions to cash after a cybersecurity incident disrupted systems across their operations.

Parent company Turning Stone Enterprises, the commercial arm of the Oneida Nation, said it had shut down selected internal systems as a precaution following the incident, which affected its network and communications.

The move will prevent customers from using credit cards at its properties on Tuesday (Nov. 3), while ATMs, sports betting, and bingo operations will be unavailable.

The incident affected Turning Stone Resort Casino in Verona, Point Place Casino in Bridgeport, and YBR Casino & Sports Book in Chittenango.

Other Turning Stone Enterprises businesses, including The Lake House at Sylvan Beach and Maple Leaf Markets and SavOn convenience stores, are also operating on a cash-only basis.

Shutdowns to Protect Guests

The company said the shutdowns were designed to protect guests’ personal information while cybersecurity specialists investigated the incident. Turning Stone has not identified the cause or said whether a third party was responsible.

According to Utica television station WKTV, Turning Stone said Monday (Nov. 8) it had found no evidence that confidential information had been accessed. The investigation remains ongoing.

The incident has also knocked out TS Rewards, the loyalty program through which patrons earn and redeem points on gambling, hotel stays, dining, and other purchases.

In a statement posted to Facebook and reported by Syracuse station WSYR, the company said its team was “working at full speed with cybersecurity experts to return to full working order,” without offering a timeline.

It said it would publish evening updates on service availability until the disruption was resolved.

Cybersecurity Risks

Casinos have faced a series of high-profile cybersecurity breaches in recent years, including ransomware attacks that have disrupted operations and exposed customer information.

Tribal casinos may be attractive targets because attackers perceive them as having weaker cybersecurity systems and fewer resources to defend against sophisticated threats, according to the FBI.

Casinos in general are popular targets for cybercriminals because they handle substantial financial transactions, store sensitive customer information, and depend on interconnected systems that can be costly to take offline, giving the attackers significant leverage.

In September 2023, MGM Resorts International suffered a cyberattack that disrupted hotel reservations, casino transactions, and other services across its US properties. The company subsequently estimated the impact on its third-quarter earnings at approximately $100 million.