Slovenia’s Hit Closed All Six Casinos After a Cyberattack. On Its Own Website, It Mentions Only System Problems

Slovenian gaming and hotel company Hit has closed all six of its casinos after a cybersecurity incident. It recorded the incident overnight from Monday to Tuesday, and its hotels have since been operating on a limited basis. The company said it immediately informed the relevant state institutions and authorities about the event and that a digital forensic analysis is under way, with experts determining the scope and content of the incident. RTV Slovenija ↗

The Perla and Park casinos in Nova Gorica are closed, as is Casino Drive-in in neighboring Šempeter pri Gorici, Mond in Šentilj near the Austrian border, Korona in Kranjska Gora, and Casino Fontana in the spa town of Rogaška Slatina. Hit’s subsidiaries, however, are operating without restrictions, including Casino Larix and Hit Alpinea, which operate in Kranjska Gora just like the closed Korona. In this resort, the decision on opening is therefore not determined by location, but by whether the operation belongs directly to Hit or to its subsidiary. Siol ↗

The company has not yet said what type of attack it was, who may be responsible for it, or whether the attackers gained access to guest or employee data. It explained that it cannot provide more information while the investigation is ongoing. Its own website is even more cautious than its statement to the media. It tells visitors that the casinos are closed “due to problems with information systems,” and the word attack does not appear in the notice at all. Hit — oznam na webe ↗

Hit is the largest gaming company in Slovenia, and most of its shares are held by the public sector. The Slovenian state holding SDH owns 28.5 percent, the state-controlled Kapitalska družba owns 20.3 percent, and the city of Nova Gorica owns another 13.3 percent, together more than 62 percent. Last year the group reported revenue of 180.4 million euros and a net profit of 6.7 million euros; in July, it paid shareholders 3.2 million euros in dividends for 2025. If the outage were to drag on, it would therefore affect not only one company, but also its public shareholders. RTV Slovenija ↗

That an attack on a computer network can halt physical operations was shown in September 2023 by the American chain MGM Resorts. After a breach of its systems, it shut down part of its infrastructure itself, and reservations, digital room keys, and slot machines stopped working in its U.S. hotels and casinos. The company later quantified the incident’s negative impact on quarterly operating results in a regulatory filing at roughly 100 million dollars, while one-off expenses for lawyers and advisers were less than ten million dollars. CNN ↗

Slovenia has its own experience with attacks on large state-owned companies. In November 2023, a ransomware attack linked to the Rhysida hacking group hit Holding Slovenske elektrarne, which produces roughly sixty percent of the country’s electricity. The attackers encrypted some files, but electricity production was not stopped, and the company said it had the situation under control within two days. BleepingComputer ↗

Shortly before that, Slovenian media became targets. At the beginning of August, attackers flooded the servers of the daily Primorske novice and the investigative website Necenzurirano with a deluge of requests, making their sites unavailable. The attack came in waves from several countries, and both newsrooms reported it to the police and the national center SI-CERT, but the attackers did not get into the systems and no data leaked. Siol ↗

In Hit’s case, none of that is certain yet. What remains verified is a narrow slice of the picture. The casinos are closed, the hotels are operating under restrictions, the subsidiaries are functioning without limitations, and a forensic analysis is under way. The company has not said who is behind the attack, what means were used, or whether anyone obtained data, and Slovenian media have so far uniformly picked up the same corporate statement. Delo ↗