Incident response for gambling operators
When a security incident hits a gambling operator, several clocks start at once: the data protection deadline, any gambling regulator notification, player communications and the business pressure to keep taking bets. A prepared playbook, based on NIST's 2025 incident response guidance, turns that into a sequence people can follow.
The framework: NIST SP 800-61 Rev 3 and CSF 2.0
NIST published SP 800-61 Rev 3, "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile", in April 2025. It supersedes the 2012 Computer Security Incident Handling Guide and states that "The six Functions of the NIST Cybersecurity Framework (CSF) 2.0 all play vital roles in incident response." CSF 2.0, released on 26 February 2024, consists of Govern, Identify, Protect, Detect, Respond and Recover; Govern is new. In the UK, the NCSC's Cyber Assessment Framework (v4.0, August 2025) covers the same ground in Objective D, "Minimising the impact of cyber security incidents".
Before an incident
- Owners: name an incident lead and deputies, and who can make decisions such as suspending deposits or withdrawals.
- Contacts: legal, data protection officer, payments, player support, key suppliers, your gambling regulator's reporting route and insurers.
- Reporting map: a one-page list of which incidents must be reported to whom and by when; see our breach notification comparison.
- Evidence: log retention long enough to investigate, time synchronization, and a process for preserving evidence; see investigation evidence.
- Templates: player notices, regulator notifications and internal updates, drafted in advance.
- Exercises: test scenarios gambling operators face, such as account takeover at scale, a game provider outage, a payment provider compromise or ransomware.
During an incident
- Detect and triage. Confirm what happened, which systems and data are involved, and whether player funds or personal data are at risk.
- Start the clocks. Record when the incident was discovered. The ICO's 72 hours guide says for personal data breaches: "The clock starts from when you discovered the breach, not when it actually happened."
- Contain. Isolate affected systems, revoke compromised credentials and sessions, and consider pausing withdrawals to new destinations if accounts are being taken over.
- Notify. Report to the data protection authority and gambling regulator where required, and to players without undue delay where the risk to them is high.
- Eradicate and recover. Remove the cause, restore from known-good backups, and monitor closely for recurrence.
- Communicate. Give players clear, factual updates: what happened, what it means for their account and money, and what they should do.
UK data breach reporting
The ICO's breach reporting page says: "If a risk is likely, you must notify us, as soon as possible, and where feasible within 72 hours", and "If the risk to people is high, you must also notify those people without undue delay." The ICO notes its guidance is under review following the Data (Use and Access) Act 2025. The NCSC runs a free incident management service and says it is not a regulator and does not share incident information with regulators without the victim's permission.
What an incident can cost
Public filings show the scale. In an October 2023 filing about a September 2023 cybersecurity issue, MGM Resorts estimated that the issue would have a negative impact of "approximately $100 million to Adjusted Property EBITDAR" in September across its Las Vegas Strip and regional operations, plus "less than $10 million in one-time expenses", and said it currently believed its cybersecurity insurance would be sufficient to cover the financial impact. Most operators are smaller, but the lesson holds: recovery speed, insurance terms and clear communication decide how much an incident costs.
After an incident
Hold a lessons-learned review within a few weeks, separate facts from assumptions, and track actions to completion. CAF Objective D includes "Lessons Learned" as an outcome. Update detection rules, the playbook and supplier contracts based on what you found.
Questions about incident response
What replaced NIST SP 800-61 Rev 2?
SP 800-61 Rev 3, published in April 2025. It reframes incident response as a CSF 2.0 Community Profile and supersedes the 2012 Computer Security Incident Handling Guide.
How quickly must a UK gambling operator report a data breach?
If a personal data breach is likely to result in a risk to people, it must be reported to the ICO as soon as possible and, where feasible, within 72 hours of discovery. Gambling license conditions may add separate reporting duties.
Sources
- NIST, SP 800-61 Rev 3 (April 2025); CSF 2.0 release (26 February 2024)
- NCSC, CAF Objective D and CAF changelog (v4.0, 4 August 2025); NCSC incident management
- ICO, personal data breach reporting; 72 hours guidance
- MGM Resorts International, Form 8-K (5 October 2023)
- All sources checked 24 October 2026.