Hacked Through a Fish Tank: Casino Loses 10GB of Data

A smart aquarium installed in a casino lobby was the entry point used to extract 10 gigabytes of high-value customer data, which was sent to a server in Finland. The case illustrates the risk of connected devices that nobody watches.

The aquarium had it all: automatic feeding, temperature control and remote monitoring. And internet connectivity, of course. That detail turned a decorative piece of furniture into a back door. Attackers found it, exploited it and pulled **10 gigabytes** of data on high-roller players out of it. The information travelled all the way to **Finland**.

## A glass fish tank on the casino network

The casino had isolated the aquarium on its own VPN. A separate, segregated network, outside the boundaries of the rest of the systems. It was useless. The intruders broke the isolation and, from the aquarium, pivoted to the main network. Silent, methodical exfiltration, spread out over time so nobody noticed the volume.

The key was camouflage. The data left using audio and video protocols, so the traffic looked like a normal streaming session. Nobody monitors the outbound traffic of a fish tank. Why would they? It's a fish tank.

## Darktrace spotted a fish tank sending data

When **Darktrace** investigated, the pattern jumped out: the aquarium was sending massive amounts of information to an external IP. It was the only device in the entire casino that had communicated with that Finnish server. Not a computer, not compromised credentials, not an email with malware. A connected fish tank.

The lesson is uncomfortable for any company with sensors, cameras or thermostats. You can protect them, block them, isolate them. They're still connected to something and still vulnerable to something. And something will find them, even if it's just checking whether the fish tank uses the default password.

## The business of devices nobody looks at

The IoT economy runs on cheap devices, installed quickly and forgotten afterwards. Each one is a potential entry point, and the cost of monitoring them never shows up on any invoice until the breach appears. For a casino, the bill is measured in customer data and fruta.

If you manage connected devices in your business, review what they send out and to whom. And if the issue hits close to home, consult a cybersecurity specialist before assuming a segmented network is safe.