Slovenian casino operator Hit begins reopening properties after cyberattack forced multi-day shutdown

Hit, a major operator of casinos, hotels and other tourism businesses in Slovenia and Bosnia and Herzegovina, has started reopening its Slovenian casinos following a cyberattack that forced six properties offline for roughly three days.

The company detected the intrusion overnight between Aug. 24 and Aug. 25, prompting the shutdown of the Perla, Park, Casino Drive-in, Mond, Korona and Casino Fontana casinos. Hit’s hotels stayed open throughout the disruption, though with reduced services, and its Casino Larix and HIT Alpinea subsidiaries continued operating without interruption.

Specialist teams launched a forensic investigation as soon as the incident was identified, and Hit alerted relevant government authorities while enlisting outside cybersecurity experts to help restore its systems. Slovenian police told local media they had been notified and were investigating.

By Aug. 28, Hit said enough of its infrastructure had been brought back online to begin gradually reopening the affected casinos, though it did not specify whether all six would resume at once. Some gaming functions and the company’s loyalty program remained down at that point, and guests were initially able to access only a limited selection of slot machines while other systems were restored.

Local news outlets reported that the outage disrupted cash registers, with some customers handed handwritten receipts at cafes, and that hotel front desks also ran into technical problems. Hit temporarily furloughed some staff whose roles depended on systems that were unavailable, though the company later said those employees were returning to work as operations came back online.

As of Monday, Hit’s website indicated the casinos were still running on limited capacity, with table games and bingo not yet restored.

Hit has released few specifics about the attack. It has not disclosed how the intruders gained access, whether any customer or company data was stolen, whether a ransom was demanded or paid, or what the financial toll has been. "We cannot publicly comment on any further details of the information security incident because the investigation is still ongoing," the company said.