Information Security in iGaming: Standards, Audits and Lessons From Recent Incidents

In September 2023 two of the biggest casino groups in the US were hit within days of each other. MGM Resorts shut systems for ten days and expected costs of more than $100 million. Caesars disclosed an attack that its online operations survived, and was widely reported to have paid a ransom. Neither attack started with a clever exploit of gaming software.

This article looks at information security in iGaming from the governance side: the standards and audits regulators expect, the deadlines that have recently passed, and what recent incidents teach operators and suppliers. For the technical layers of casino software security, see casino software security.

The Standards That Apply

ISO/IEC 27001:2022

ISO 27001 is the information security management standard most gambling regulators point to. The 2013 version has been replaced. Certificates to the old version expired after 31 October 2025, so any operator or supplier with ISO 27001 should now hold the 2022 version.

PCI DSS 4.x

If you store, process or transmit card data, PCI DSS applies. Version 3.2.1 was retired on 31 March 2024, and the future-dated requirements in version 4.0 became mandatory on 31 March 2025. Many operators reduce their exposure by letting a payment provider handle card data directly.

What Regulators Require

UK Gambling Commission

The Commission’s Remote Technical Standards include security requirements based on 44 controls from ISO 27001:2022 Annex A. They apply to critical systems: those holding customer payment or balance data, RNGs, game results, entry and exit points to the network, and networks carrying sensitive data. Cloud services control 5.23 was added from 31 October 2024.

Remote casino, betting and bingo licensees, among others, must have an annual security audit against ISO 27001:2022 covering those requirements. The first audit is due within six months of the licence being granted, and major non-conformities must be reported without delay.

Malta Gaming Authority

MGA licensees go through a system audit before going live and a system review about a year after the licence is issued, carried out in the live environment by MGA-approved audit service providers.

Ontario

The AGCO’s standards for internet gaming require operators to follow a recognised security framework, carry out regular security assessments by a qualified person, including of suppliers, and use multi-factor authentication.

NIS2 in the EU

Gambling isn’t listed as a sector in the EU’s NIS2 directive, but operators can still fall within scope through their size, as digital service providers or through supply chains, and their IT and cloud suppliers often are in scope. Malta and Italy have both transposed NIS2 into national law.

Lessons From Recent Incidents

Three lessons stand out. First, people are the usual way in. Attackers in the 2023 casino attacks were widely reported to have used social engineering against help desks, not software flaws. Second, reused passwords are an ongoing risk for player accounts, which is why credential stuffing works and why multi-factor authentication matters. Third, the supply chain is part of your attack surface: suppliers, regulators’ portals and IT providers all hold your data.

Read more: Security ProTips: How to Implement Strong Phishing Protection for Your iGaming Clients

DDoS Is Still a Gambling Problem

Cloudflare’s DDoS report for the fourth quarter of 2025 ranked gambling and casinos as the third most attacked industry. Cloudflare said it mitigated 47.1 million DDoS attacks over 2025, more than double the year before. For an operator, an attack during a major match or tournament is lost revenue and lost trust, so DDoS protection should be tested before peak events, not after.

A Practical Security Checklist

• Hold ISO 27001:2022 certification or align your controls with it, and keep audit evidence ready.
• Keep card data out of your systems where possible and confirm your PCI DSS scope.
• Use multi-factor authentication for staff and offer it to players.
• Train help desk and support staff to verify identity before resetting access.
• Review suppliers’ security, including incident notification terms.
• Test DDoS protection and incident response before major events.
• Know which incidents you must report to each regulator, and how fast.

FAQ

Is ISO 27001 mandatory for online casinos?
In Great Britain, remote casino, betting and bingo licensees need an annual security audit against ISO 27001:2022. Other regulators require security audits or frameworks without always naming ISO 27001.

Do I need PCI DSS if I use a payment provider?
Usually your scope is much smaller, but rarely zero. Confirm with your provider and acquirer which parts of PCI DSS still apply to you.

What is the most common cause of breaches in gambling?
Recent major incidents point to social engineering and stolen or reused credentials rather than flaws in game software.

Security in iGaming is now an audited, deadline-driven discipline. Keep your certifications current, treat staff and suppliers as part of the attack surface, and practise your response before you need it. If you run on a white label platform, check which of these controls your provider covers. Our guide to white label casinos explains who is responsible for what.

Gamingsoft is a leading iGaming aggregator connecting casino operators with over 200 top-tier game studios through a single API integration. Our GS Connect platform provides instant access to more than 10,000 games across slots, live casino, sports betting, and fishing games — without requiring separate negotiations with each provider. We support multiple currencies and languages, making it simple to enter new markets quickly. Our technical team is available around the clock to ensure seamless platform performance. Whether you are launching a new platform or expanding an existing game library, Gamingsoft has the tools and partnerships to accelerate your growth. Get in touch to learn what we can do for your business.