When MGM Resorts was hit by a cyberattack in 2023, the company’s own estimate put the total cost of the resulting shutdown at around $100 million — with hotel check-ins, digital room keys, slot machines, and reservation systems all down for roughly ten days. It’s one of the most cited incidents in the industry precisely because it showed, in dollar terms, what everyone in iGaming already suspected: platform downtime isn’t a technical inconvenience. It’s a direct hit to revenue, licensing standing, and player trust, all at once.
The scale of that particular incident was unusual, but the underlying exposure isn’t. Industry estimates put missed betting revenue from platform outages at roughly $735 million in a single year across the online gambling sector, and security researchers reported that around a quarter of gambling sites were hit by a DDoS attack in a recent sample month. Entering 2026, threat intelligence firms are describing sustained, organized pressure on the gambling and entertainment sector — not just opportunistic attackers, but coordinated fraud operations testing platforms for weak points.
For operators, the practical question isn’t whether an online casino or sportsbook will eventually face an outage or an attack attempt — it’s whether the infrastructure underneath the platform is built to absorb it without taking the business down with it.
Why iGaming platforms are a specific kind of hard target
Online casinos and sportsbooks combine several characteristics that make them more exposed than most consumer web platforms:
- Uptime is directly monetized, in real time. A retailer’s site going down for ten minutes loses some sales. A sportsbook going down during a major match loses active in-play bets, cash-out requests, and — often permanently — the players who switch to a competitor mid-event.
- They’re a magnet for DDoS attacks specifically because they’re easy to knock offline and expensive to leave down. Both volumetric floods that saturate bandwidth and application-layer attacks that mimic real player traffic against login pages, odds feeds, and payment endpoints are common, and the latter is far harder for generic defenses to catch.
- They run real-time, latency-sensitive services — live-dealer video, in-play odds, jackpot draws — where a few hundred milliseconds of added latency is a player experience problem even before anything actually breaks.
- They sit under some of the strictest compliance regimes of any consumer internet business, spanning multi-jurisdiction licensing, PCI-DSS for payment processing, AML/KYC data handling, and RNG certification for game fairness — all of which infrastructure decisions can either support or quietly undermine.
- They depend on a wide vendor surface — payment processors, game aggregators, KYC providers, odds feeds — and, as seen in casino cybersecurity incidents in recent years, third-party and vendor remote-access tooling is consistently one of the most common entry points for attackers, not just the platform’s own code.
What actually breaks: three failure patterns
Traffic that legitimate demand generates. The most predictable outages aren’t attacks at all — they’re launches, major sporting events, or promotional pushes that spike concurrency past what the platform was provisioned for. Unlike a generic SaaS product, an iGaming platform’s traffic pattern is genuinely bursty and event-driven, which makes static capacity planning a losing strategy.
DDoS and application-layer abuse. Volumetric attacks are the obvious case, but HTTP floods that closely mimic normal player behavior — repeated hits on login, odds, or payment APIs — are increasingly the more damaging variant precisely because they’re harder to distinguish from a genuine traffic spike until the platform is already struggling.
Data exposure through misconfiguration, not just intrusion. One of the more instructive incidents in the sector’s history wasn’t a sophisticated hack at all — it was an unsecured database left exposed, putting betting records, account data, and identity documents for over a million users at risk. Infrastructure hardening prevents this class of incident just as much as it prevents deliberate attacks.
A practical resilience framework for iGaming operators
1. Provision for bursty, event-driven load — not average load. Autoscaling tied to real concurrency metrics, load-tested against projected peaks before a major event or launch, not after. Kubernetes-based game and platform server fleets that scale up for a launch or a big match and scale back down afterward keep this from becoming a permanent cost.
2. Put purpose-built DDoS mitigation in front of the platform, not just a generic firewall. CDN-based scrubbing that filters malicious traffic at the edge — before it reaches origin servers — handles both the volumetric and application-layer cases, and as a side effect usually improves baseline latency for live-dealer and in-play products too.
3. Build real disaster recovery around Recovery Time and Recovery Point Objectives that match the business, not generic defaults. Betting data needs transactional integrity — a database failure mid-wager can’t produce an orphaned bet — which typically means synchronous replication and write-ahead logging tuned specifically for real-time transaction flows, not a nightly backup.
4. Treat vendor and third-party access as part of the attack surface. Payment processors, game aggregators, and remote support tooling all need the same least-privilege, logged, regularly reviewed access controls as the core platform — vendor remote-access tools are a recurring entry point in casino sector breaches.
5. Design compliance into the infrastructure, not on top of it. Multi-jurisdiction licensing, PCI-DSS, and RNG certification readiness all go smoother when data residency, audit logging, and access segmentation are architectural decisions from day one, rather than a retrofit before a regulator’s review.
6. Monitor for the incident before players do. Real-time dashboards on concurrency, latency, and error rates, with alerting that reaches a human before social media does. The MGM incident and similar cases show that the length of the outage — not just the fact that it happened — is what determines the financial and reputational damage.
At Gart Solutions, this is the core of our iGaming infrastructure practice: cloud architecture and DevOps services built for multiplayer and real-money platforms, paired with SRE services for the monitoring and incident response that keeps a launch-day spike or an attack attempt from becoming a multi-day outage. For operators who need to confirm where their exposure actually sits before a regulator or an attacker finds it, we also run infrastructure audits and compliance auditscovering data sovereignty and multi-jurisdiction licensing requirements.
The bottom line
The gambling industry’s biggest infrastructure incidents share a common thread: they weren’t unforeseeable. Predictable traffic spikes, known DDoS vectors, and vendor access sprawl are all well-understood risks with well-understood mitigations. The operators that treat platform resilience as core infrastructure work — not a line item added after a bad night — are the ones still processing bets when a competitor’s platform goes dark.
Frequently asked questions
How much does downtime actually cost an online casino or sportsbook? It varies by platform size and timing, but the range is large: a short outage during a quiet period might cost a few thousand dollars in lost bets, while a multi-day incident during a major event can run into tens or hundreds of millions when direct revenue loss, regulatory exposure, and player churn are all counted — as MGM Resorts’ roughly $100 million estimate illustrates.
Is DDoS protection enough to keep an iGaming platform online? No — it addresses one failure mode. Traffic spikes from legitimate demand, database failures during high-volume betting, and vendor-access compromises are all separate risks that need their own mitigations: autoscaling, transactional disaster recovery, and third-party access controls, respectively.
Why do live-dealer and in-play betting products need different infrastructure than a standard casino lobby?Latency is a direct product quality issue for real-time video and in-play odds — a few hundred milliseconds of lag is noticeable to players and can affect bet timing. These products typically need dedicated low-latency architecture and CDN placement rather than sharing generic infrastructure with the rest of the platform.
What should an operator check first if they’re not confident in their current infrastructure? An independent infrastructure audit that maps capacity planning, DDoS protection, disaster recovery objectives, and third-party access against actual traffic and compliance requirements — rather than assuming existing hosting is sufficient because it hasn’t failed yet.
Does infrastructure investment help with licensing and compliance, or just uptime? Both. Multi-jurisdiction gaming licenses, PCI-DSS for payment processing, and RNG certification all have infrastructure-level requirements around data residency, logging, and access control. Building these in architecturally is typically far less costly than retrofitting them under regulatory pressure.
About the author
Fedir Kompaniiets is CEO & Co-Founder of Gart Solutions, a cloud, DevOps, and digital transformation consultancy. He advises online casino, sportsbook, and iGaming platform operators on infrastructure architecture, uptime engineering, and compliance-ready cloud design, drawing on hands-on experience across AWS, GCP, Azure, and high-concurrency real-time systems.