Hackers Stole Las Vegas Casino High-Roller Database Via Its Fish Tank

Hackers are gravitating from phishing to fish tanks, according to a cybersecurity expert, who related this week how criminals were able to steal a casino’s high-roller database by gaining access to its computer network via a smart thermostat in its tropical aquarium.

Speaking at the WSJ CEO Council Conference in London, Nicole Eagan, the CEO of cyber defense company Darktrace, said that once the hackers had breached the system of the unnamed Las Vegas casino they were able to “pull [the database] back across the network, out the thermostat, and up to the cloud.”

News of the casino fish tank heist came amid warnings that hackers are increasingly targeting “internet of things” (IOT) devices to find their way into corporate networks. As internet-connected smart gadgets and appliances become more common, they are creating more weak links in corporate security, said Egan.

Monster Botnet

In 2016, the virulent Mirai botnet was able to harness the power of thousands of IOT devices across the world to launch the most powerful distributed denial of service (DDoS) attack ever recorded.

DDoS attacks cripple a company’s servers with thousands or requests for information and are typically accompanied by a ransom demand to restore normal services.

Online gaming websites have long been targets for ransomed DDoS attacks, but hackers intent on stealing data are increasingly turning to land-based casinos in search of the financial details of wealthy patrons.

Hard Hit Hard Rock

The Hard Rock Las Vegas, among others, has been embarrassed by a series of breaches in recent years. Since May 2015, hackers have, on three separate occasions, been able to steal cardholder names, credit card numbers, and CVV codes from Hard Rock customers.

Also on the panel in London was Robert Hannigan, who ran the British government’s digital-spying agency, Government Communications Headquarters (GCHQ), from 2014 to 2017. He called for more regulation to establish a framework of safety standards for IOTs.

“With the internet of things producing thousands of new devices shoved onto the internet over the next few years, that’s going to be an increasing problem,” Hannigan said. “I saw a bank that had been hacked through its CCTV cameras, because these devices are bought purely on cost.

“It’s probably one area where there’ll likely need to be regulation for minimum security standards, because the market isn’t going to correct itself,” he added. “The problem is these devices still work – the fish tank or the CCTV camera still work.”