Casino Cyber Breach

  1. The cyber-attack encrypted data that was on the network, which made the information inaccessible. Nez Perce Tribal Enterprise Executive Officer Kermit Mankiller confirmed Friday there had not been a data breach and no personal information stored in the systems was shared or compromised. 'We continue to work diligently toward resolving the issue.
  2. Ontario's Casino Rama Resort says customer information has been stolen after an alleged cyberattack. Social Sharing The Ontario casino became aware of a security breach on Nov.
  3. MGM Grand casino-hotel in Las Vegas, Tuesday, Jan. After discovering the security breach, MGM brought in two cybersecurity forensics firms to assist with an internal investigation.

Most people know about phishing -- but one casino recently learned about the dangers of actual fish tanks.

Casino cyber breach settlement

Hackers attempted to steal data from a North American casino through a fish tank connected to the internet, according to a report from security firm Darktrace.

Privacy Breach at the Casino Rama Resort On November 10, 2016, the Casino Rama Resort (Casino Rama) announced that it was informed on November 4, 2016 that its internal computer network was subjected to a cyberattack in which confidential data of employees, customers and vendors was stolen.

Despite extra security precautions set up on the fish tank, hackers still managed to compromise the tank to send data to a device in Finland before the threat was discovered and stopped.

'Someone used the fish tank to get into the network, and once they were in the fish tank, they scanned and found other vulnerabilities and moved laterally to other places in the network,' Justin Fier, director for cyber intelligence and analysis at Darktrace, explained to CNN Tech.

As internet-connected gadgets and appliances become more common, there are more ways for bad guys to gain access to networks and take advantage of insecure devices. The fish tank, for instance, was connected to the internet to automatically feed the fish and keep their environment comfortable -- but it became a weak link in a the casino's security.

The unnamed casino's rogue fish tank is one of nine unusual threats that Darktrace identified on corporate networks published in a report Thursday.

The report cites examples compiled from Darktrace's threat detection technology. Darktrace makes security technology that sits on a company's network and monitors the activity taking place. That could be anything from data transferred between computers or actions taken by a connected coffee maker.

When the technology notices an anomaly -- like a device that doesn't belongor data being sent somewhere it shouldn't -- it alerts the company's security team.

In another example of an unusual attack, smart drawing pads connected to insecure wifi were used to send data to websites around the world in what's called a 'denial of service' attack. A hacker had scanned the internet looking for vulnerable devices, and exploited them to try and flood other websites with too much traffic.

We've seen cybercriminals leverage connected devices for destructive purposes before.

Last year, the Mirai botnet took control of smart home devices, like security cameras, all over the world, effectively turning them into zombie machines directing web traffic to take down popular websites like Netflix and Twitter.

Fier, a former U.S. intelligence contractor, says he anticipates threats coming from more unexpected places. Phishing emails will be one way hackers can get onto systems. But things like insecure fish tanks connected to the internet will be another.

'In the current cyber climate with political and corporate espionage, I think you're going tostart to see attackers, whether nationstate or criminal, having to get more creative in their attack vectors,' Fier said.

CNNMoney (San Francisco) First published July 19, 2017: 7:00 PM ET
Last Updated March 25, 2019

Privacy Breach at the Casino Rama Resort

On November 10, 2016, the Casino Rama Resort (Casino Rama) announced that it was informed on November 4, 2016 that its internal computer network was subjected to a cyberattack in which confidential data of employees, customers and vendors was stolen. The privacy breach was reported to the Privacy Commissioner of Canada and the Information and Privacy Commissioner of Ontario. Casino Rama reported that it is also working with the Ontario Provincial Police (OPP), the Royal Canadian Mounted Police (RCMP), the Ontario Lottery and Gaming Corporation (OLG) and the Alcohol and Gaming Commission of Ontario to address the issue.


May 7, 2019

Superior Court declines to certify class action against Casino Rama.

Read the decision here.

March 25, 2019

The Privacy Complaint Report of the Information and Privacy Commissioner of Ontario was released on January 30, 2019. In the report, the investigator concludes:

  • Casino Rama did not have reasonable security measures in place to prevent unauthorized access to records.
  • A total of 39 Casino Rama network systems had been compromised in the attack.
  • A number of security measures required by legislation were not implemented at the time of the cyber attack.
  • Audit report recommendations made by the AGCO in 2015 were not implemented at Casino Rama due to limited IT resources. The failure of Casino Rama to implement the audit report recommendations contributed to the cyber attack.

A summary of the Privacy Complaint report prepared by Charney Lawyers can be found here.

The Privacy Complaint Report of the Information and Privacy Commission of Ontario can be found here.

January 17, 2019

In November 2018, the certification hearing commenced before Justice Belobaba, but was adjourned at the court’s request to allow for further evidence to be filed on the scope of the breach and the number of affected individuals. We anticipate the hearing will resume in spring 2019 and will post further information when it becomes available. We encourage anyone who received notice of the breach from Casino Rama or who was affected by the breach to register at the link above and to continue to visit this site for further updates.

November 2, 2018 – The motion to certify this action as a class action will be heard on November 7 and 8, 2018 in Toronto.

June 6, 2018 – The plaintiffs recently successfully argued a motion to compel the defendants to produce an investigation report authored by Mandiant, a third party cybersecurity company. Mandiant was hired by Casino Rama to investigate the breach immediately after it occurred, and produced a report on its findings. Casino Rama claimed privilege over the Mandiant report, but Justice Glustein ruled that privilege had been waived and ordered the production of relevant portions of the report. You can read Justice Glustein’s reasons for decision here.

Casino Rama’s Press Statements

On November 10, 2016, Casino Rama posted a statement on its website announcing the privacy breach. On November 11, 2016, Casino Rama update the statement to indicate that personal information obtained by hackers has been posted online. The statement can be viewed here.

Who Is Affected and What Confidential Information Was Compromised?

According Casino Rama’s statement, an anonymous hacker claims to have stolen confidential employee information from 2004 to 2016 including performance reviews, payroll data, terminations, social insurance numbers and dates of birth.

Casino Rama also stated that the hacker claims to have stolen other confidential information dating back to 2007, including the Casino Rama’s IT information, hotel and casino financial reports, security incident reports, email, customer credit inquiries, collection and debt information and vendor information and contracts. Some of Casino Rama’s affected customers received an email from Casino Rama advising of the privacy breach.

Privacy Commissioner Investigation

The privacy breach was reported to the Privacy Commissioner of Canada and the Information and Privacy Commissioner of Ontario. On November 10, 2016, the Information and Privacy Commissioner of Ontario posted a statement advising that it has launched an investigation. The statement may be viewed here.

Casino Rama Privacy Breach Class Action

On November 14, 2016, Charney Lawyers PC and Sutts, Strosberg LLP (now Strosberg Sasso Sutts LLP) commenced a national class action on behalf of Casino Rama employees (past and present), customers and vendors for damages arising from the privacy breach. The plaintiffs also seek damages on behalf of members of the OLG’s Self-Exclusion Program whose personal information was provided to Casino Rama by the OLG.


The proposed class consists of all persons residing in Canada, excluding the defendants and the defendants’ executives, whose personal information was collected by Casino Rama, or was provided to Casino Rama by the OLG, and was then stolen or accessed in the breach.

The defendants are Casino Rama Services, Inc., the OLG, CHC Casinos Canada Limited and Penn National Gaming, Inc.

In the action, the plaintiffs assert that the defendants were negligent and that Casino Rama breached its Privacy Policy by failing to take reasonable security measures to protect against unauthorized access to class members’ personal and confidential information.

Casino Cyber Breach Lawsuit

On May 10, 2017, Justice Belobaba of the Superior Court of Justice in Toronto ordered that carriage of the proposed class action be granted to the plaintiffs represented by Charney Lawyers PC and Strosberg Sasso Sutts LLP, who have served a motion record for certification of the proposed class action. A copy of the decision can be viewed here. A separate class action concerning the Casino Rama privacy breach, commenced by Flaherty McCarthy LLP in Oshawa, has been stayed. The plaintiffs’ motion for certification of the proposed class action has been delayed due to the unavailability of the court to hear the motion as originally scheduled. New dates have been booked for the hearing of the certification motion on April 25-27, 2018. Further details on the outcome of that motion will be posted here as soon as they are available.

What to Do Next?


Anyone who received a notice of the privacy breach from Casino Rama or who believes their private information may have been compromised is urged to immediately notify their banks and credit card companies and to monitor their accounts for suspicious activities. Affected individuals may also contact a credit bureau such as TransUnion Canada or Equifax to determine whether there have been any unauthorized transactions on their accounts to explore options to purchase credit protection services.

Register for the Casino Rama Class Action

Casino Cyber Breach Update

Employees, customers or vendors of Casino Rama who provided their confidential information to Casino Rama as early as 2004 and/or who received Casino Rama’s notice of the breach are also urged to REGISTER HERE to receive updates about the class action, especially if there is a settlement or award of damages.

Contact Us

If you have any questions, please contact:

Casino Cyber Breach Settlement

Tina Q. Yang
Charney Lawyers PC
[email protected]

Casino Cyber Breach 2019

David Robins