What happened in 2026
Here are the main public cases this year. A DDoS attack, mentioned below, floods a site with fake traffic until it slows or goes offline.
| When | Who | What happened |
|---|---|---|
| March (notified May) | Station Casinos | One employee account was compromised; personal data including Social Security numbers may have been exposed |
| June | European betting platform (unnamed) | About 19 million malicious bot requests in three weeks during the World Cup, plus a flash DDoS, per DataDome |
| August | Oddschecker | The odds-comparison site confirmed passwords, contact details and dates of birth were exposed |
| September | IDScan.net | Breach of an ID-scanning platform used in venues; a seller claims to have 153 million license scans (unverified) |
| Early November | Turning Stone, Point Place and YBR (Oneida Nation) | A cyber incident forced cash-only operations; ATMs, sports betting and loyalty systems went down |
A group of online blackmailers also claimed to have DraftKings advertising data in November. That claim is unconfirmed.
Why gambling operators are targeted
Gambling firms have four traits that attract attackers:
- Real money moves in real time, and downtime is costly. That puts operators under pressure to pay.
- They hold large amounts of personal and payment data, plus ID documents from KYC (the identity checks on new players).
- Big events happen on known dates, so attackers can time DDoS and bot attacks to do the most harm.
- Many suppliers: platform providers, game studios, payment firms and ID vendors all hold data.
Lessons from these incidents
- Plan for running without IT. Turning Stone had to go cash-only. Know how you would keep trading, and what you would switch off, if core systems go down.
- Protect accounts, not just networks. A single hacked staff account was enough at Station Casinos. Use phishing-resistant MFA, a second login step (such as a passkey) that fake websites cannot steal. Watch for unusual logins.
- Your suppliers are your risk. The IDScan breach shows that data you hand to a supplier can leak from them. Review supplier security and what data they keep.
- Get ready for event peaks. Tune bot and DDoS defenses before big tournaments, not during them.
Controls every operator should have
Use this list to check your current setup. Each item closes one of the gaps seen in this year's attacks.
- Always-on DDoS protection and bot blocking, tested before major events
- 24/7 monitoring of logins, payments, admin actions and withdrawals
- Phishing-resistant MFA for staff, especially help desk, finance and admin roles
- Regular penetration testing (hiring experts to try to break in) of the player platform, cashier, back office and APIs
- Offline backups and a rehearsed incident response plan
- Supplier security reviews, including platform and ID-verification providers
These also make your UKGC security audit and MGA system audit much easier.
Sources
Need a hand with this?
Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.
Written by
NextGarrison Security TeamPenetration testers, SOC analysts and compliance consultants
Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.