Image by Gideon Strathmore
On February 19, 2020, ZDNet reported that personal details of more than 10.6 million former MGM Resorts hotel guests had surfaced on a hacking forum: full names, home addresses, phone numbers, email addresses and dates of birth.
MGM told the outlet it had found unauthorized access to a cloud server the summer before and was confident no financial, payment card or password data was involved.
A hotel guest list is a thin record next to an online games account. Before a licensed operator lets anyone play, it must verify the player’s identity and age, and it usually stores a way to pay; every session afterward adds to a history the regulator may ask to see years later.
The useful question for a security team is which control guards which part of that file.
The answer comes in layers: encryption, tokens that move card numbers elsewhere, and rules on who can read what remains, several of them made compulsory by the license.
Sweepstakes operators gather much of the same identity paperwork under a different rulebook, and the 2023 attacks on MGM Resorts and Caesars Entertainment showed where designs like these give way.
The license fixes what goes into the file
New Jersey’s internet gaming rules leave an operator little say over what it collects. Identity comes first: the operator either inspects a government ID and writes down its number or uses a remote, multi-source method approved by the state’s Division of Gaming Enforcement, one that may check outside and government records.
The file also logs the method and the date, and the player must be 21 and not on an exclusion list.
Card and bank account numbers can join the file too, and then the history grows. A New Jersey gaming system must hold whatever it needs to rebuild a player’s sessions and account activity, identity and location checks included, for no less than 10 years.
Alberta has operators keep event and security logs for at least a year online, seven years in archive.
Because the license sets both contents and retention, an operator can’t cut its exposure much by collecting less. Its real choices concern protection.
Tokens can take card numbers out of the games systems
New Jersey requires patron traffic crossing a public or third-party network to travel in encrypted packets or over a secure protocol, with account numbers, user IDs, passwords and PINs sent by an approved secure method.
At rest, the patron file must encrypt Social Security numbers or their foreign equivalents, passwords and PINs, and card and bank account numbers.
Alberta’s standards set a floor for the algorithms themselves, at industry levels such as AES-256 and RSA-2048, reviewed at least once a year, and require encrypted, immutable backups with quarterly restore tests.
Card numbers have an exit that identity data lacks. Guidance the PCI Security Standards Council published on August 12, 2011 describes swapping the card number for a surrogate token, so a properly built system can reduce or remove a merchant’s need to keep card numbers after the first transaction.
The merchant stays responsible for getting it right, but done well, the card number can sit with a payment processor while the casino keeps only the token.
Card data that stays in scope answers to PCI DSS v4.0.1, whose future-dated requirements became mandatory on March 31, 2025.
Since then, every non-console login into the cardholder data environment has needed multi-factor authentication, and payment pages have needed a script inventory and tamper detection.
A passport number has no such exit. The license wants it retrievable for investigators, so somebody inside the company must be able to read it. For identity data, access control matters more than encryption.
The license turns account access into an audited control
Both regimes make access something an outside reviewer can check. New Jersey’s rules go furthest on the player’s front door; Alberta’s newer standards, in a market open since July 13, 2026, go furthest on staff.
| Control | New Jersey (Division of Gaming Enforcement) | Alberta (AGLC) |
| Player login | Strong authentication offered at sign-up; an alert on every login unless the player opts out | Multi-factor authentication offered; no third party may use the account |
| Failed and idle logins | Disabled after three failed attempts; re-entry after 15 idle minutes | Automatic log-out after a set period of inactivity |
| Staff and administrator access | System security procedures filed with the Division before use | Phishing-resistant MFA, privileged access tooling with session recording, quarterly access reviews |
| Logs | Separate logging device run by an employee with no incompatible function | Tamper-protected, sent over TLS 1.2 or higher, monitoring split from operations |
| Outside review | Annual independent security assessment, reviewer approved by the Division | SOC 2 Type 1 before launch; ISO 27001 or SOC 2 Type 2 two years later |
New Jersey’s reset rule reads like advice for any help desk. A player’s password or PIN can be reset only with proof of identity in person, correct answers to two or more challenge questions, or strong authentication, and the player is told afterward.
Ontario’s AGCO standards, in force since the province’s online market opened in 2022, extend multi-factor authentication and lockouts to staff accounts and want misuse of an administrator account reported to the Registrar.
The rules bite through review: New Jersey’s annual assessment reaches the Division with findings, the recommended fix and the operator’s response, so a missing control lands on the regulator’s file.
Sweepstakes operators verify the same documents under their own rules
Apart from PCI DSS, every control so far hangs on a casino license. Sweepstakes operators sit outside that licensing structure and run as promotional sweepstakes under official rules they publish themselves, yet a prize redemption pulls in the same kind of identity file.
The records look alike while the rulebook differs, so the security question carries over.
Spree’s overview of the format, Sweepstakes Casino, walks through the account side: a short registration form, an email address to verify, Gold Coins that stay play-only, and Spree Coins, the redeemable ones under its sweepstakes rules and eligibility requirements.
It lists redemption minimums of 100 SC for cash and 10 SC for gift cards.
The sweepstakes rules behind that overview say a player may face a Know-Your-Customer check before any prize is redeemed, which may include government-issued photo identification, a facial scan, proof of address and validation of the player’s Social Security number.
The terms of service add age and identity checks and may ask for a utility bill, a payslip or a bank statement.
The age floor is 18, rising wherever a jurisdiction’s age of majority is higher.
Two provisions in those documents shrink what an intruder could take. Prize redemptions go only to a bank account in the player’s own name, which the rules justify on security and anti-money-laundering grounds.
And the privacy policy, last modified in 2023, says a third-party processor handles all payment transactions and the company will not have access to players’ credit card numbers.
That policy also describes commercially reasonable physical, electronic and administrative safeguards, including limits on who can physically reach its database servers.
Outside casino licensing, published documents like these are where a sweepstakes operator puts its security commitments on record.
The 2023 breaches pointed to IT support, not to broken encryption
The attacks on Caesars and MGM tested the access layer directly. Caesars Entertainment’s filing, made public on September 14, 2023, traced suspicious network activity to social engineering of an outside IT support vendor.
It said the intruder had copied the loyalty program database, which held driver’s license or Social Security numbers, in some cases both, for what it called a significant number of members, while the online and mobile gaming apps kept running.
MGM’s October 5 filing did not say how the attackers got in. BleepingComputer reported, citing the research group vx-underground, that they allegedly phoned MGM’s help desk posing as an employee, and Bloomberg linked both intrusions to the group known as Scattered Spider.
Cyber Security News has tracked the group’s phone attacks on IT support teams, and their aim is consistent: a password or MFA reset approved by someone who believes the caller.
MGM’s filing said the company shut its systems down to protect customer information, disrupting some of its properties but keeping the criminals away from bank account and card numbers.
Driver’s license numbers and other personal details still left for some pre-March 2019 customers, as did Social Security or passport numbers for a smaller group.
CISA and the FBI described the playbook in an advisory first published on November 16, 2023 and updated in 2025: impersonate an employee, get the help desk to reset a password, move the MFA token to a device the attacker controls.
Its mitigations include phishing-resistant MFA, which Alberta now requires for administrator accounts. Neither filing describes broken encryption. What left in both cases was identity data.
New Jersey’s breach clock runs to the police first
When a control fails, state law and the license start separate clocks. New Jersey’s breach statute covers any company doing business in the state and requires notice to affected residents without unreasonable delay, but the Division of State Police hears first, before any customer. Notice can wait if law enforcement says it would hurt an investigation.
The statute adds quieter duties. A breach needing notice to more than 1,000 people must also go to the nationwide consumer reporting agencies, and a vendor holding records for another business must tell that business immediately.
A company that concludes misuse isn’t reasonably possible, and skips notice, has to record that decision in writing and keep it for five years.
Alberta’s regulator wants to hear at once. Its current notification matrix asks operators to notify AGLC immediately on becoming aware of a significant suspected or potential cybersecurity incident or breach, with updates and an incident report to follow.
Its breach definition includes an authorized user accessing personal information for an unauthorized purpose, so a curious employee browsing ID scans qualifies.
The courts run the slowest clock. MGM’s $45 million settlement with affected customers covered both the 2019 leak and the 2023 attack, and a federal judge in Nevada granted final approval on June 18, 2025.
It priced the records: an estimated $75 where a Social Security or military ID number was exposed, $50 for a passport or driver’s license number.
Anyone about to upload a passport scan should ask which rulebook governs the file and what it demands after a failure. State breach statutes such as New Jersey’s apply to licensed and sweepstakes sites alike.
Beyond that baseline, a licensed casino’s security controls come from its regulator’s standards, while a sweepstakes operator’s come from the terms and privacy policy it publishes.
A player who can’t find those answers in writing has learned something before uploading anything.
