Cyber Incident Victim: Gateway Casinos and Entertainment

On the weekend of April 15, 2023, Gateway Casinos and Entertainment detected a cybersecurity incident impacting its operations. The company, which operates a number of casino properties across Ontario including Casino Rama, took immediate action by closing its operations in the province in response to the detected threat. This closure was a containment measure taken to isolate the incident and prevent further potential damage to the company's IT infrastructure and data systems. The primary initial response was to shut down access to the affected environments to stabilize the situation and allow for a forensic investigation to begin.

Following the detection and initial containment through operational shutdown, Gateway Casinos and Entertainment engaged external cybersecurity expertise. The company retained third-party cyber professionals to assist in the response and recovery efforts. These experts were tasked with working around the clock, on a 24/7 basis, to analyze the breach, assess the damage, and ultimately work to restore the compromised IT environment. The core objective of this engagement was to rebuild and secure the systems necessary for the safe resumption of casino operations across Ontario.

Concurrently, the company began the process of assessing the potential impact on sensitive data. A primary concern stated by the company was the protection of personal data and information. In its initial public communications, Gateway Casinos stated that at that point in the investigation, it did not have any information indicating that the incident involved any compromise of personal data. Despite this early assessment, the company initiated the process of notifying relevant regulatory and oversight bodies. This included making notifications to the appropriate privacy officials and the provincial gaming regulator, adhering to standard protocols for reporting significant cybersecurity events.

Public communication regarding the incident and the ongoing closures began on April 16, 2023. Gateway Casinos utilized its official Instagram account to post a detailed statement informing the public and its stakeholders of the situation. This statement was subsequently reported on by major news outlets, including the Toronto Star, on April 17th. The communication confirmed that the closures would extend for the "coming days" as the restoration work continued. The company expressed appreciation for the patience of its employees, customers, and government partners during the disruptive period.

The impact of the incident was significant and directly affected the business operations of all Gateway Casinos locations in Ontario. The complete closure of casino gaming facilities meant a full halt to revenue-generating activities from those operations for an indeterminate period. However, not all amenities at every property were affected. Specifically, at Casino Rama Resort, the hotel, the Balance In Life Spa, and two restaurants—Weirs and St. Germain's—were confirmed to remain open and operational. St. Germain's restaurant operated on a reduced schedule, open from Wednesday through Sunday.

The response effort was focused intensely on the restoration of the IT environment. The work of the third-party cyber professionals constituted the main technical response action, with the goal of rebuilding systems to a secure and stable state. This process involved meticulous work to ensure that systems were not only restored but also hardened against future attacks before being brought back online for business use. The company committed to providing further public updates regarding the timeline for reopening its properties as the restoration work progressed.

The incident occurred within a broader context of increased cyber threat activity targeting Canadian organizations. Contemporary news reporting on the Gateway Casinos event noted it was part of a string of high-profile cyber attacks, citing a recent incident that had knocked out the website and mobile application of Quebec’s power utility. This observation placed the casino attack within a wider pattern of disruptive cyber events affecting critical infrastructure and large commercial entities, highlighting the persistent threat landscape faced by organizations across various sectors.

The full scope and specific technical nature of the cyber security incident, including the attack vector used by the threat actors or the specific malware involved, were not disclosed in the available public statements. The company’s communications did not elaborate on whether the event constituted a ransomware attack, data breach, or another form of cyber intrusion. The lack of confirmed details on the attacker's identity or motives indicated an ongoing investigation where such information had either not been determined or was not yet being shared publicly.

The business continuity impact was clear, with the closure affecting multiple properties and their patrons. The prolonged downtime suggested a severe compromise that required a thorough and time-consuming recovery process, rather than a simple technical outage. The engagement of specialized external incident response teams further indicated the seriousness of the compromise and the need for expert resources beyond the company's internal capabilities to manage the situation effectively.

The potential data protection implications remained a critical aspect of the incident, even with the company's initial statement suggesting no evidence of a personal data compromise. The proactive notification of privacy officials was a precautionary measure, acknowledging the possibility that the investigation could later uncover evidence of data access or exfiltration. This step demonstrated an adherence to privacy compliance obligations and a commitment to transparently engaging with regulators amid an unfolding event.

Throughout the response, the company maintained a consistent message focused on system restoration, data protection, and recommitment to reopening safely. The public communications strategy was centralized, using social media platforms like Instagram to disseminate official statements directly to the public and then relying on traditional media to amplify the message. This approach aimed to manage public perception and provide a single source of truth regarding the operational status of the casinos and the ongoing recovery efforts. The incident represented a significant operational disruption for Gateway Casinos and Entertainment, requiring a comprehensive response involving external experts, regulatory engagement, and a careful process of system restoration before normal business operations could resume across its Ontario properties.