Loading story…
A cyberattack on the servers of Slovenian gambling and tourism operator Hit forced six casinos offline for about three days, disrupting gaming systems, loyalty services, cash registers, and hotel reception operations. The outage also led to temporary employee furloughs after the company detected the incident overnight between August 24 and 25 and shut down affected systems.
Hit engaged external cybersecurity specialists, notified authorities, and began a forensic investigation alongside Slovenian police. The operator has restored enough infrastructure for a phased reopening with limited gaming capacity, but table games, bingo, and the loyalty program remain unavailable; Hit has not disclosed the intrusion vector, whether data was stolen, whether ransomware was involved, or the financial impact.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
As of Monday, Hit's casinos were operating on a limited basis, with table games, bingo, and the loyalty program still unavailable. Temporarily furloughed employees were returning as systems were restored.
On August 28, Hit said it had restored enough IT infrastructure to gradually reopen the affected casinos. Initially, guests could access only a limited selection of slot machines while other systems and applications were restored.
After identifying the incident, Hit began a forensic investigation, engaged external cybersecurity specialists, and notified relevant authorities. Slovenian police opened an investigation into the attack.
Overnight between August 24 and 25, Hit detected a cyber intrusion and shut down affected operations at six Slovenian casinos, which remained offline for roughly three days. The outage disrupted gaming systems, loyalty services, cash registers, and hotel reception operations; hotels remained open with reduced services while some employees were furloughed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Boyd Gaming Corporation, a major US casino and gaming operator, suffered a cyberattack that resulted in unauthorized access to its internal IT systems and the theft of employee data and information on a limited number of other individuals. The company disclosed the incident in a filing with the US Securities and Exchange Commission, stating that business operations and casino properties were not affected. Boyd Gaming is working with external cybersecurity experts and law enforcement, and is notifying impacted individuals and regulators. The company expects its cyber insurance policy to cover incident response costs and regulatory fines, and does not anticipate a material impact on its financial standing.
Jun 29, 2026
Multiple organizations reported or resolved matters related to cyber incidents affecting sensitive personal data. **Choice Hotels International** disclosed that a “skilled person” used **social engineering** to access (despite **MFA**) an application containing records for franchisees and franchise applicants, exposing data including **names and Social Security numbers**; the company indicated the incident involved franchise-related records rather than guest data. Separately, **Wynn Resorts** had not publicly responded to claims by **ShinyHunters** that the actor obtained roughly **800,000 records**, with no proof posted and no apparent public filing or statement at the time referenced; reporting suggested the alleged exposure may involve employee data rather than guest data. In Taiwan, **The Grand Hotel (Taipei)** reported detecting unauthorized access and stated it could not yet rule out impact to **customer/guest data**. In healthcare, a small medical practice in Northern Ireland (**Grange Dental Care**) reported a compromise that led to **fraudulent emails** being sent from the practice’s systems requesting invoice payments; the practice stated it identified the issue quickly and engaged its IT provider to contain and investigate, with initial indications the attack originated overseas. Separately, **Granite Wellness Centers** (California) and **Pediatric Home Service** (Minnesota) agreed to **class action settlements** tied to earlier cyberattacks exposing patient data; Granite’s matter stems from a **January 2021 ransomware attack** in which files containing extensive patient and identity data were confirmed accessed, and the organization agreed to a **$725,000 settlement fund** while denying wrongdoing and liability.
Jun 29, 2026
MGM Resorts and Caesars Entertainment were hit in closely timed cyberattacks that investigators and security firms tied to the **Scattered Spider** criminal community, a loose English-speaking group known for social engineering, SIM swapping, phishing, and MFA fatigue. Caesars disclosed that attackers stole customer data and reportedly paid a ransom demand, while MGM suffered a far more disruptive intrusion that knocked hotel and casino operations offline for days and was later estimated to have cost about **$100 million**. Multiple reports said the intrusions involved help-desk impersonation and other employee-targeting tactics, with Scattered Spider affiliates also linked to ransomware operators including **BlackCat/ALPHV**. The fallout expanded beyond the initial breaches as Caesars sent breach notifications to thousands of affected people and both casino companies faced lawsuits and class actions alleging failures to protect personal information. Law enforcement pressure then intensified: investigators in the US, UK, and Spain pursued suspected Scattered Spider members, including a 22-year-old British man arrested in Spain as an alleged leader and a 17-year-old arrested in the UK over the MGM attack, with additional US arrests and prosecutors reportedly moving closer to charges. Security researchers said the Las Vegas casino intrusions put a bullseye on the group, which had evolved from SIM-swapping into ransomware, extortion, and cloud-focused intrusions against major enterprises.
Jun 29, 2026