Don’t call it a cyberattack: Gaming Control Board gives security update

The Nevada Gaming Control Board said Wednesday an investigation has confirmed that no personal information was accessed or acquired by any unauthorized persons as a result of a cybersecurity incident in late January.

But the state’s gaming industry regulator stopped short of calling the incident a cyberattack and did not indicate if investigators are seeking any criminal suspects.

The Control Board’s website appearance has changed since it became inaccessible in late January.

The board, on Jan. 25, issued a statement on X, formerly known as Twitter, saying it had taken measures to protect the website by taking it offline.

Wednesday’s board statement said the board used “established protocols” to prevent further damage. Specifically, the board chose to shut down the existing website and transitioned to a new website platform under the guidance of the Nevada Office of the Chief Information Officer. An investigation was conducted by the Control Board Information Technology team, the Office of the Chief Information Officer, other law enforcement agencies and external legal and forensic experts.

The board did not respond to inquiries about whether evidence was found that the incident was a cyberattack or if any suspects are being sought.

Gaming officials are sensitive to cybersecurity breaches, particularly after the state’s largest casino companies – MGM Resorts International and Caesars Entertainment Inc. – were victims of a cyberattack in late summer in 2023.

MGM weathered nine days of websites being down, but didn’t capitulate to ransom demands.

Caesars reportedly paid a $15 million ransomware demand, but never skipped a beat resulting from downed sites. The company has not confirmed ever paying a ransom.

The two companies ended up losing millions of dollars in lost reservations and inconvenience, but MGM said it recovered most of its money through insurance.

The Control Board website was gradually restored over about a five-day period and investigators said no personal or financial information was exposed.

The Control Board’s public-facing website provides board agendas, statistics, casino indices, regulations and biographical information about Control Board members and gaming commissioners.

Contact Richard N. Velotta at rvelotta@reviewjournal.com or 702-477-3893. Follow @RickVelotta on X.