Digital gaming, casino, and sports betting giant IGT hit by ransomware

International Game Technology (IGT), a global provider of digital gaming, sports betting, and fintech for casinos and online platforms – including the popular Wheel of Fortune and Megabucks million-dollar jackpot slots – has been claimed by the Qilin ransomware group.

The Russian-linked ransomware group posted IGT on its dark leak blog on Wednesday, although the post provided limited information.

Qilin claims to have exfiltrated 10GB of data from the "Gambling & Gaming" company, which the group lists as the equivalent of 21,683 files.

From gaming machines and lottery systems to PlaySports betting platforms and iGaming, IGT products are used in casinos, lottery retailers, and online platforms. Its technology solutions are used by millions of players worldwide each day, according to its website.

The cybercriminal outfit has stamped the entry with the word "Publicated" in bright green letters, leading to the assumption that either IGT has not made contact with the gang or has refused to pay the suggested ransom demand.

No proof samples were posted in Qilin's IGT entry, but the gang does provide an FTP link, presumably to download the alleged stolen cache.

Cybernews has reached out to IGT headquarters in Las Vegas for comment, but has not heard back at the time of this report.

IGT provides casino management and payment solutions

IGT is said to operate in over 100 nations across the US, Canada, Latin America, Europe, the Middle East, and Africa.

With over 275 digital games on its docket, IGT’s offering spans gaming machines, game content and systems, iGaming, sports betting, cash access, loyalty, and player engagement solutions,” the company states.

Not just a gaming provider, IGT is a full-service company that additionally offers clients casino and hospitality management, complete with a digital and financial technology business unit, as well as cash management.

The company’s fintech division also provides casinos with compliance tools, payment solutions, and customer credit services, all of which could store a vast amount of customer personally identifiable information, putting individuals at risk of identity theft and social engineering attacks.

IGT has also given away billions in prize money over the years according to the company,

Big jackpots in the last 8 weeks include a Powerbucks slots player winning $1.4 million in New York, a Wheel of Fortune slots player winning $1 million, and a Megabucks slots player winning $3.2 million, both in Calfornia.

“Wheel of Fortune slots have minted over 1,200 millionaires and awarded over $3.6 billion in jackpots,” IGT says.

Some of the company’s most popular games also include Tiger and Dragon, Major Multipliers, Double Chili Mania Extremo, and WOF Big Money Spin.

Operating in both “land-based and digital environments,” IGT has over 7,000 employees located across the globe. On July 1st of this year, IGT Gaming and Digital Businesses were acquired by The Apollo Funds for $1.85 billion.

Qilin ransomware gang dominates 2025

The Qilin gang claims that it began operating in 2021, although its first known attack was recorded in 2022.

Since then, the Russian-linked cartel has aggressively outperformed its ransomware rivals, becoming the most active ransomware group of 2025, and claiming more than 500 attacks in the last six months alone.

According to Cybernews' in-house surveillance tool, Ransomlooker, the gang has listed 991 victims since 2023, with many well-known names on the list.

Just this month alone, the gang targeted the US multi-state Cornerstone Staffing Solutions, exposing the resumes of 120,000 job seekers, as well as the North American industrial electrical contractors Spark Power and the Switzerland-based international Habib Bank AG Zurich, allegedly comprising two million files.

A recent profile on the group by Comparitec states that Qilin primarily targets manufacturers, finance companies, retailers, healthcare providers, and government agencies, as these sectors store sensitive information and can suffer the most from data breaches.

When it comes to affected countries, Qilin has hit the US with the most attacks (375), followed by France (41), Canada (39), South Korea (33), and Spain (26).

Known for using a ransomware-as-a-service (RaaS) business model, the cybercriminal group often uses double-extortion tactics, demanding a ransom for decryption and then a second payout to guarantee the stolen files will not be leaked.

Qilin is known for actively recruiting affiliates on Russian-language hacker forums, and avoids targeting Commonwealth of Independent States (CIS) countries, suggesting a Kremlin-aligned agenda.

Recently allied with the notorious Russia-linked gang LockBit and DragonForce, Qilin made waves in October with attacks on Japan's largest beer producer, Asahi Holdings, Volkswagen Group France, California Golf Club of San Francisco (Cal Club), and Israel's 4th largest hospital, Shamir Medical Center, on Yom Kippur.

Qilin has additionally claimed attacks this year on Nissan Japan's design arm, Creative Box, and US pharmaceutical research conglomerate Inotiv, and US pharmacy benefits manager MedImpact Healthcare Systems.

Other past Qilin victims further include California PR firm Singer Associates, energy and manufacturing giant SK Group, US newspaper conglomerate Lee Enterprises, the Houston Symphony, Detroit’s PBS TV station, top North American auto parts suppliers Yanfeng in China, and the Utsunomiya cancer treatment center in Japan.

Unlock more exclusive Cybernews content on YouTube.