Ontario casino ransomware attack 'as bad as it gets,' expert says

Ont. casinos have long road to recovery: expert Technology analyst Carmi Levy says Gateway Casinos has a long road to recovery after a cyberattack forced the closure of multiple casinos.

Several casinos in Ontario remain closed nearly two weeks after a cyberattack, with no official reopening date.

The ransomware attack that knocked the servers out to Gateway Casinos facilities was first detected on April 16.

Technology analyst Carmi Levy said the situation is the digital equivalent of recovering from a major fire or similar disaster.

"It's as bad as it gets. And unfortunately, the damage is going to take years to undo, even if they are able to undo it," the London, Ont.-based digital expert said. "You don't just flip a switch and come back on."

On Thursday, Gateway posted online it hopes to reopen using a phased approach "later this week; however, the reopening timeline depends on the pace of restoration and approval by regulatory bodies."

The cybersecurity incident impacted operations to 14 casinos, including Casino Rama in Orillia, Georgian Downs in Innisfil, and Playtime Casinos Wasaga Beach.

According to Levy, the recovery procedure is a "multi-faceted, multi-staged process" involving highly-trained people.

"We call these 'business killer events' for a reason. Many companies that are targeted successfully by ransomware never fully recover. The direct costs will be into the millions if not the tens of millions or beyond," the tech analyst said.

While the company has said there is no evidence to believe customer's data was breached, Levy believes it's possible.

"There is a very strong likelihood that it has been - that it is either being bought and sold on the dark web or will be at some point in time because all of these ransomware events tend to play out in the same way. There's no coming back from that. ," he noted.

While Casino Rama's gaming floor remains closed to gamblers, the Orillia facility welcomed back concertgoers Thursday night in an attempt at getting some operations back to normal.

"The concert was very well attended, and people seemed very excited to be there," said Rob Mitchell, director of communications at Gateway Casinos and Entertainment Limited.

A Scotty McCreery concert is scheduled to go ahead on Saturday.

Still, the digital analyst believes Gateway will have a long road ahead.

"Gateway Casinos is going to have to own this, and they are going to have to work hard to reestablish the trust of customers and other stakeholders who have done business with them in the past who may be hesitant to do so going forward, for good reason."

Levy noted extensive training is the key to avoiding digital attacks.

"Organizations aren't training their people well enough to recognize the signs of a phishing type of message that shows up in their inbox. That's how all of these attacks are initiated," he said. "Clearly, someone clicked on the wrong thing in this event. Clearly, someone is going to click on the wrong thing in future events. It's time Canadian businesses got wise to this and started redirecting their cyber security investments toward their people."