Casinos in Las Vegas and across the United States remain a persistent target for cybercriminals, and the growing use of artificial intelligence by attackers is sharpening the threat for operators. Rick Arpin, managing partner in Las Vegas for consulting and advisory firm KPMG, told industry observers that the gaming sector is “always under attack” and ranks among the most visible targets for hackers. The warning lands as operators absorb the lessons of high-profile breaches and recalibrate their defences against a faster, more adaptive adversary.
What has changed is not the motive. It is the speed.
Why Casino Cybersecurity Just Got Harder
Before the specifics, a quick frame for executives weighing exposure: the threat is not theoretical, the financial consequences are measurable, and AI is lowering the cost of an attack while raising the cost of defence.
- The gaming industry is a high-visibility target. Casinos hold large volumes of payment data, customer identity records, and cash flow that make them attractive to both opportunistic and organised attackers.
- Operators have already moved through repeated “waves” of incidents, according to Arpin, suggesting that breaches are cyclical rather than one-off events.
- AI is amplifying risk on the attacker side by enabling more convincing social engineering, faster reconnaissance, and automated probing of weak points.
- The reputational hit can outlast the technical one. Customer trust, once dented, is slow to rebuild.
- Boards now treat cyber resilience as an operational continuity issue, not just an IT line item.
A Sector Built on Data, and Therefore on Risk
The modern casino floor runs on information. Loyalty programmes track spending patterns. Hotel systems store passport and payment details. Slot networks, surveillance feeds, and back-office finance platforms all connect to the same digital nervous system. That interconnection is what makes the business efficient, and it is also what makes a single compromised credential dangerous.
Arpin’s point about recurring “waves” of incidents matters because it reframes the problem. This is not a question of whether an operator will be tested, but how often and how well it absorbs the hit. And while attackers vary in sophistication, the entry point is frequently the same: a person, not a firewall.
That human layer is where AI changes the maths. Phishing emails that once carried clumsy grammar now read cleanly. Voice cloning can mimic an executive authorising a transfer. Automated tools scan for unpatched systems around the clock. The result is a threat environment where the barrier to launching a credible attack keeps falling (a trend defenders have struggled to price into their budgets).
What AI Adds to the Attacker’s Toolkit
Generative tools and machine learning give criminals leverage they did not have a few years ago. The mechanics are worth spelling out plainly.
| Capability | How attackers use it | Effect on operators |
|---|---|---|
| Social engineering | AI-written phishing and cloned voices impersonate staff or vendors | Higher success rate on credential theft, even among trained employees who would have caught earlier, sloppier attempts |
| Automated reconnaissance | Scanning networks for exposed systems at machine speed | Shorter window between vulnerability and exploitation |
| Adaptive malware | Code that adjusts to evade detection | Greater pressure on monitoring tools |
| Scale | Running many attacks in parallel | More attempts, more often |
None of these are exotic. They are the same attack types operators already know, made cheaper and quicker. Which raises a harder question for security teams: if the attacker is using AI to move faster, can a defence built on human review keep pace?
The Business Case for Resilience
A breach at a casino is rarely contained to one system. Downtime on gaming and hotel platforms interrupts revenue directly, and operators with significant Las Vegas exposure feel that hit in real time. There is the cost of remediation, the cost of regulatory scrutiny, and the slower bleed of customer confidence.
Gaming is a heavily regulated industry, and operators answer to state-level commissions that expect demonstrable controls around data and continuity. A serious incident invites questions from those regulators about whether reasonable safeguards were in place. At least on paper, the compliance obligation is clear. In practice, proving “reasonable” after the fact is where many operators find themselves exposed.
Arpin’s framing of the sector as a perpetual target carries a practical implication. Spending on cyber defence is no longer discretionary. It is the cost of operating a data-rich business in plain sight.
Where Operators Go From Here
The defensive playbook is shifting toward the same technology attackers exploit. Some operators are deploying AI-driven monitoring that flags anomalies in network behaviour faster than human analysts can. Others are tightening identity verification, segmenting networks so a single breach cannot cascade, and rehearsing incident response before an event rather than during one.
Staff training remains the unglamorous front line. Most successful intrusions still begin with someone clicking something they should not have. No amount of automated detection fully compensates for that, which is why the human layer keeps drawing investment even as the tools around it grow more sophisticated.
The precedent set by recent high-profile breaches gives regulators a clearer template for what they expect, and it gives boards a harder number to weigh against the cost of prevention.
Frequently Asked Questions
Why are casinos such frequent targets for hackers?
They combine large volumes of payment and identity data with high cash flow and interconnected systems spanning gaming, hospitality, and finance. KPMG’s Rick Arpin described the industry as a “high-visibility target” that has moved through repeated waves of incidents.
How is artificial intelligence changing the threat?
AI lets attackers produce more convincing phishing, clone voices, scan networks faster, and run attacks at scale. It lowers the skill and cost needed to mount a credible attack.
Is the risk limited to Las Vegas?
No. The warning applies to casinos nationwide, though Las Vegas operators carry concentrated exposure given the density of large properties.
What can operators actually do?
Layered defence works best: AI-driven monitoring, stronger identity controls, network segmentation, tested incident response, and continuous staff training. The last one matters more than its low-tech reputation suggests.
