Turning Stone Casinos Switch to Cash-Only After Cybersecurity Breach Disrupts Operations

Turning Stone Resort Casino and its affiliated tribal gaming properties in upstate New York have been forced into cash-only operations following a cybersecurity incident that disrupted systems across their network. The move affects transactions at Turning Stone Resort Casino in Verona, Point Place Casino in Bridgeport, and YBR Casino & Sports Book in Chittenango, as well as other Turning Stone Enterprises businesses, including The Lake House at Sylvan Beach and convenience stores.

Parent company Turning Stone Enterprises, the commercial arm of the Oneida Nation, announced the shutdown of selected internal systems as a precautionary measure. The incident has rendered credit card transactions unavailable at its properties on Tuesday, November 3, while ATMs, sports betting, and bingo operations are also offline.

The company stated in a statement, ‘We are working at full speed with cybersecurity experts to return to full working order’, without providing a timeline for resolution. Updates on service availability will be published in the evenings until operations resume.

According to WKTV, a local television station, Turning Stone confirmed there is no evidence that confidential guest information was accessed during the incident. However, the investigation remains ongoing, and the company has not yet identified the cause or confirmed whether a third party was involved.

The disruption has also impacted the TS Rewards loyalty program, leaving patrons unable to earn or redeem points for gambling, hotel stays, dining, and other purchases.

This incident underscores the growing threat of cybersecurity risks in the iGaming industry. Casinos, including tribal properties, are increasingly targeted by cybercriminals due to their handling of substantial financial transactions and sensitive customer data. The interconnected nature of casino systems makes them particularly vulnerable, as attackers can exploit weaknesses to disrupt operations and demand ransoms.

In September 2023, MGM Resorts International suffered a cyberattack that disrupted hotel reservations, casino transactions, and other services across its US properties. The company estimated the financial impact on its third-quarter earnings at approximately $100 million. The FBI has previously warned that tribal casinos may be attractive targets due to perceived weaker cybersecurity systems and limited resources to defend against sophisticated threats.