Part IV: Financial Fraud · Internal Collusion & Employee Fraud · #8.25

Database Breach and Customer Information Theft

How it works

Employees with access to customer databases can steal personal information including names, addresses, Social Security numbers, financial account information, and player card data. This information can be sold to identity thieves, used to create fraudulent credit applications, or exploited for direct financial gain. The Nevada Gaming Control Board has investigated numerous cases involving the compromise of player club program databases. A 2011 Las Vegas Review-Journal report described bribing an employee to download customer data as a possible risk. It did not describe a completed case. The threat extends beyond casinos themselves - smartphone applications that require personal information are also targets. In a January 2011 Las Vegas Review-Journal report, security analyst Jon Oltsik said targeted attacks on casino databases primarily came from Eastern Europe. That was his comment, not a regulator or police finding.

Where it appears

Customer databases, player club systems, mobile applications, financial records

On the record

In December 2010 the Nevada Gaming Control Board wrote that it had investigated numerous incidents in which patron databases were compromised. In January 2011 its enforcement chief said the Board was investigating several cases involving players’ club programs and stolen points. In 2010 Cisco said some Cisco Live attendee listings were accessed through the event website. The conference was at Mandalay Bay. Cisco was not sure the access was unauthorized and the data was not in the resort’s database. The Wynn Resorts data breach (2025-2026) affected 21,000+ employees when hackers targeted HR systems.

Published as a detection reference for surveillance, compliance and gaming-operations professionals. Thresholds and tuning are set by the property. Nothing here is instruction: the method is described so it can be recognised.