Ohio Lottery Hacked: Cybercriminals Steal Data and Demand Ransom

The Ohio Lottery announced on its website that it was hit by a cyberattack on December 24. The hack has disrupted the site and app features, blocking users from cashing out online winnings and checking tickets for some lottery games (like KENO, Lucky One, and EZPLAY Progressive Jackpots).

The lottery’s official statement said that the attack did not affect the actual lottery draws, which will continue as scheduled. The statement also assured that payouts for winnings up to $600 and ticket verification are still available at lottery retail locations.

However, the statement was unclear about whether the hackers leaked any customers’ personal information. The hackers, a ransomware group called DragonForce, have claimed that they did. 

They said they stole over 600 Gb of players’ and company employees’ personal data, including passport details (first name, last name, date and place of birth, IDs, etc.) and winning amounts.

The cybercriminals are asking for a ransom to keep the stolen information secret. They have not revealed the exact ransom amount, and they suggest negotiating the price.

It is unknown whether the lottery representatives will agree to the hackers’ demands, but they have launched an investigation into the incident and contacted law enforcement agencies.

DragonForce is a relatively new and obscure group. They are probably not the same hackers who targeted MGM and Caesars Entertainment gambling sites in the fall.