Cyberattack Sidelines Oregon Lottery’s SBTech-Powered Scoreboard App

Oregon Lottery suspended operations of its sports betting app, Scoreboard, on March 27, after a worldwide cyberattack on its platform provider partner, SBTech.

The attack prompted SBTech to shut down more than 50 online gaming sites worldwide that run on its proprietary platform.

An email from Oregon Lottery to Scoreboard users on March 30 explained that the shutdown was a precautionary measure, and there were no reports of a breach of user data, which includes sensitive financial details.

SBTech “brought its systems offline as a precautionary measure in response to a cyberattack — suspending play on Scoreboard and other online sportsbooks using the platform,” according to the March 30 email.

“We have no reports of unauthorized disclosure or extraction of player data or account balances.”

The Lottery’s said that the London-based company is investigating the incident and working toward bringing its systems back online while Oregon Lottery monitors the process.

Some overseas media reports speculate that the cyberattack was ransomware. The Trojan malware intended to infect the system in order to extort money in exchange for releasing infected servers, or ceasing a DDoS (direct denial of service) attack in which servers are overloaded by repeated floods of messages.

There does not appear to be a basis for those claims. SBTech’s initial report states that the motive for the attack was unclear at that early stage. However, nothing recently has been disclosed.

Oregon Lottery’s troubles escalate

Scoreboard has faced numerous difficulties since going live in October 2019.

The Oregon Lottery’s sports betting app lost more than $2.3 million through January, despite net revenue accrual of more than $4.5 million.

Updated projections predict losses of $5.3 million by the end of the fiscal year, even though OR Lottery initially projected winnings of more than $6 million.

This surprising financial data prompted two media groups to file for the release of the Oregon Lottery/SBTech contract under Oregon Public Records Law.

The lottery released a heavily redacted version of the contract, including financial details. SBTech had argued that full disclosure of its contract would expose trade secrets and enable competitors to copy its business model.

The state’s office of the attorney general ruled that the Oregon Uniform Trade Secrets Act did not apply to a public entity and ordered the lottery to release the contract in its entirety.

The coronavirus outbreak caused the Oregon Lottery to shut down all of its video poker and slot machines located in restaurants and retailers across the state after Gov. Kate Brown ordered those businesses to close to all but takeout customers.

In addition, the cancellation of sporting events around the globe severely limited Scoreboard’s sports betting lineup.

SBTech partnered with operators in six states

In addition to Oregon, SBTech is partners with casino operators in five additional states. They include brick-and-mortar sportsbooks at Oaklawn Racino in Arkansas and multiple land-based sites in Mississippi.

SBTech’s online operations affected in the US include, most notably, New Jersey’s popular Golden Nugget. The online casino has been experiencing increased traffic during NJ’s stay-at-home order during the COVID-19 pandemic.

BetAmerica online sportsbooks and casinos in Indiana and Pennsylvania are shut down, as well.

European disruptions in service due to the cyberattack include the popular sites NetBet, Bethard and ComeOn, among many others.

In order to reopen operations, SBTech will have to beef up its online security and receive the green light from gaming regulators in each state.

DraftKings acquisition of SBTech

Perhaps significant to the cyberattack’s timing is the recent acquisition of SBTech and Diamond Eagle Acquisition by gaming giant DraftKings last year.

The DFS and sportsbook behemoth will be led by DraftKings co-founder and chief executive officer Jason Robins and the company’s highly experienced management team.

DraftKings is set to go public next month. Negotiations are ongoing, with a Diamond Eagle logistical meeting scheduled for April 9.