Lucky Star Casino

Summary

Lucky Star Casino experienced a ransomware attack that forced the temporary closure of all its statewide locations. The organization publicly announced the shutdown through a social media post, later confirming the cyber incident disrupted operations. The attack compromised the casino's systems, leading to a multi-day outage affecting customer access and business continuity. No further details regarding data theft or ransom demands were disclosed in initial reports, though the event highlighted significant operational vulnerabilities. Recovery efforts were initiated to restore services across affected facilities following the security breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Lucky Star Casino experienced a disruptive cybersecurity incident in mid-June 2021 that forced statewide operational closures. On Saturday, June 12, 2021, the casino announced via Facebook that all its physical locations across Oklahoma would temporarily close, though the initial statement did not disclose the nature of the problem. This unplanned shutdown occurred over the weekend, indicating immediate operational impacts affecting multiple facilities simultaneously. By Monday, June 14, 2021, the organization confirmed publicly that a ransomware attack caused the closures, though no specific threat actor group was identified in available reports. The attack timeline suggests systems were compromised before the weekend shutdown, as ransomware typically requires time for encryption and propagation across networks before activation.

The casino's response involved physical location closures as containment measures while addressing the attack, though technical remediation details remain undisclosed. No customer data theft or financial system breaches were explicitly confirmed in available reports. Business continuity impacts were significant, with multiple days of lost revenue across all properties during the closure period. The organization relied on social media for public communications rather than formal press releases during the initial response phase. Recovery timelines and ransom payment status were not disclosed in confirmed sources. Operational disruptions demonstrated the attack's severity in compromising core systems necessary for casino functions.

Sources

Sources available to members: 1 source.