LAS VEGAS (KTNV) — State gaming regulators are looking to speed up the process for casinos and resorts to report cybersecurity incidents.
Over the past five years, multiple properties have dealt with cyberattacks, including Caesars Entertainment, MGM Resorts, and Boyd Gaming.
SEPTEMBER 2025: Teen arrested in Las Vegas for involvement in 2023 MGM, Caesars cyberattacks
On Thursday, the Nevada Gaming Control Board met to discuss proposed changes to current regulations.
According to senior deputy Attorney General Ed Magaw, those changes would include:
- reducing the time period that entities have to notify the board about breaches from 72 hours to 24 hours,
- submitting an initial cyber incident response report within five days of becoming aware of any incidents, and
- providing the board with written updates every 30 days after the initial report until the incident is fully resolved.
Several IT experts and members of the resort community expressed concerns about decreasing the time they're required to notify regulators.
"Primarily, our issue is that we may not be able to determine whether it's a material breach within 24 hours of the discovery of the breach. We would still be doing forensic analysis of the data to understand, really, what the extent of the loss could potentially be," said Eric Hanson, information security officer for Affinity Gaming. "We would need at least 72 hours in order to make sure we can meet that reporting requirement."
Chandler Pohl, vice president and legal counsel for MGM Resorts International, explained how casinos get to that 72-hour number.
"For instance, you could have a contract with an external vendor who can examine things like a cybersecurity incident, and those vendors under contracts may have 48 hours to do the analysis to tell the covered entity what may have happened," Pohl told the board. "The company itself would want at least 24 hours to review what the external vendor has provided, which leads us to 72 hours."
Board members said they don't need to know all the specifics within 24 hours, but they want a heads-up that something happened so they know what to expect.
"What we're really asking for is, 'something went wrong on our property, we believe it qualifies as a cyberattack incident,' and just a phone call to the chair," said Kristi Torgerson, Nevada Gaming Control Board chief. "We don't want to see that in the media. We want to be notified first, as your regulatory group."
After hearing testimony, the board looked at changing the language from 24 hours to the moment an actual breach has been determined.
"I understand the point that things could happen, and there might be all sorts of conjecture about there was a cyberattack at that location, and we can't help that," Chairman Mike Dreitzer said. "But at the end of the day, I think it's good regulatory practice for this conversation. Once the licensee determines that a material breach has occurred, and at that point, we'd be notified within 24 hours, irrespective of the social media stuff that's going to happen that we can't necessarily control."
The board also looked at language that clarifies what types of cyberattacks they need to be notified about.
"A material breach or material incident has a very specific connotation to it," Hanson said. "Without this phrase material, we literally get hundreds of cyberattacks a day. So without having a successful cyberattack or a successful cyberattack that results in either the loss of control or the loss of data within the environment, we would be spending literally all day long reporting cyberattacks."
Board member Judge George Assad said he hopes that by streamlining the process, gaming regulators and gaming establishments will be on the same page faster when responding to critical incidents.
"I remember when Caesars and MGM got hit about two and a half years ago. It was very chaotic for the licensees or, as you call them, the covered entities, and it was kind of chaotic on our end over here," Assad said. "We were trying to get the information so that we could deal with the press, with the governor, his office, and so forth. I think it's important that we get notified immediately within 24 hours."
The board didn't make any final changes but said they will create a new draft with public testimony in mind, which will be presented and considered by the Nevada Gaming Commission, possibly as early as January.