Who should decide whether to hold a result or pause payouts during a security incident?

A named draw-operations owner, with finance and compliance alongside, decides. Responders recommend based on what they can show was touched, preserve evidence and contain accounts and credentials, but they do not alter a draw or a result on their own. Write the names, the contact routes and the maximum time to reach each person into the runbook before the first draw.

What is the first thing to preserve when a ticket or result tampering is suspected?

The frozen ticket set and the result pipeline state, exactly as they are. Export or snapshot ticket tables, the freeze-job record, the draw workflow log, the current and previous result values and the winner list before anyone repairs or regenerates anything. Record who took each snapshot, when, and where it is stored.

How is a lottery incident different from an online casino incident?

Value is concentrated in a few irreversible, time-fixed events: the sales cutoff, the draw, the result release and the payout. A casino incident is usually about accounts, cashier flows and platform availability. A lottery incident can also be about whether a ticket set, a result or a winner list was altered, which makes evidence ordering and decision ownership more important than speed of repair.

Can an incident response team certify that a draw was fair?

No. Random number generation and draw certification are assessed through separate laboratory or regulator-defined processes. Responders can establish who accessed and changed the systems around the draw and what the logs show, and that evidence can support the people who do make a fairness or validity decision.

What should a lottery operator's incident response retainer say?

It should name the response clock, escalation contacts on both sides, and access to ticket, draw-workflow, result and payout logs, including those held by vendors. It should also say how responders join a call with draw operations while a draw window is open, and what they will not do without the operator's written instruction.

Incident Response for an Online Lottery: Draw Integrity

The short answer

A lottery incident differs from a casino incident because value sits in a few fixed, irreversible events: the sales cutoff, the draw, the result release and the payout. Decide in advance who may hold a result, freeze payouts or annul a draw. Seal the ticket set, draw log, result values and winner list before anything is repaired, and keep responders out of the draw decision itself.

Who this is for

This is for a CTO, head of operations or risk owner at an online lottery operator, or at an iGaming company that runs lottery products, who is preparing an incident response retainer or tabletop for the draw cycle. It does not repeat the general first-hours model; for the casino version read Incident Response Retainers for Online Casinos. The same decision-ownership problem in another fixed-event product is covered in Incident Response for an Online Poker Room. The detection side of the same draw cycle is in Managed SOC for an online lottery, and the attack surface in online lottery penetration testing.

Why the casino runbook is not enough

A casino runbook assumes you can isolate a host, reset credentials, restore service and then work out what happened while players mostly wait. A lottery adds three facts that change the first hour.

The decisive events happen once. A draw is run, a result is released, winners are paid. You cannot replay them to see what happened, so the records around them are the only evidence, and an overeager repair can overwrite it.
The schedule is public. Draw times, cutoffs and result publication are published and often tied to licence conditions. Delaying, repeating or withholding a result affects every ticket holder and has consequences that responders are not placed to judge.
Operators and vendors hold powerful tools. Back-office tools, schedulers, result pipelines and prize engines can write to tickets and winner lists. A compromised operator or service account in these tools is an integrity incident, not only an access incident.

The consequence is that the first deliverable of a lottery response is not a fix. It is a sealed copy of the state of the draw cycle and a clear answer to "who decides next?"

A steel evidence table in a lottery back office with a sealed tamper-evident case holding a ticket-file drive, a paper custody ledger and one lime-green seal tag — The first move is a sealed, logged copy of the ticket set and draw records with a named custodian, before anyone repairs or regenerates anything.

The first-hours decision table

Use this as the working table for a tabletop or a retainer annex. It orders decisions by the phase of the draw cycle in which the incident is found, because the right first action depends on whether sales are open, a draw is pending or payouts are running. Treat it as a starting structure to adapt to your own platform and licence, not a finished procedure; it contains no timings because the right values depend on your schedule and vendors.

Phase when found	What is at stake	Responders do first	Decision owner
Sales open	Account takeover, purchase fraud, channel abuse	Contain accounts and keys; preserve edge and application logs	Security lead with product
Between sales close and the draw	Ticket set altered or added after cutoff	Snapshot the frozen ticket set and the freeze-job record; restrict writers to ticket tables	Draw-operations owner decides whether the draw proceeds
During the draw	Draw workflow started, repeated or paused by an unexpected account	Preserve workflow and scheduler logs; revoke the unexpected credential only if it does not alter the run	Draw-operations owner, with compliance
Result prepared or released	Result changed or published through an unusual path	Snapshot current and prior result values and the publication log	Draw-operations owner; compliance where your licence requires
Winners being calculated or paid	Winner list edited, manual payouts, duplicate payout calls	Snapshot the winner list and prize postings; restrict the posting role	Finance and draw-operations owners
Any time	Vendor-hosted draw or retailer platform compromised	Invoke the vendor contact path; request their logs in writing	Vendor-management owner with legal

Two rules sit behind the table. First, containment may touch accounts, sessions, keys and network paths, but never the draw, the result or the winner list. Second, any step that could change evidence, such as a restart, a regeneration or a rollback, waits for the snapshot.

Evidence that is easiest to lose

Lottery evidence is time-bound and spread across tools owned by different teams. Prioritise the items that disappear fastest or are overwritten by a normal repair.

The ticket set at cutoff. Table exports or database snapshots, the freeze-job run record and the time sales were closed. Preserve the raw channel submissions, including retailer and partner batches.
Draw workflow and scheduler logs. Who started, paused or repeated a draw, from which account and device, and the exact times.
Result values and publication records. The current result, any earlier value, and the log of the pipeline that published it. Keep the published copy as players saw it.
Winner list and prize-engine records. Calculation runs, edits, approvals and the identity of each approver.
Wallet and payout postings. Manual adjustments and prize postings, compared later against the winner list.
Operator and service authentication logs. New devices, off-shift logins, credentials created shortly before the event.
Vendor-held logs. For hosted draw, retailer or payment systems, the vendor's own logs are the ones you cannot reach quickly. Ask for them the moment an incident starts.

Follow ordinary forensic hygiene: record who took each copy and when, store hashes if your tooling supports them and keep originals read-only. The method follows public guidance on integrating forensics into incident response, listed in the sources below.

Decision ownership

The costliest lottery mistake is a technical team making a draw decision. Holding a result, repeating a draw, freezing payouts or reopening sales can have legal, licensing and reputational consequences that sit outside engineering. Split the actions into three bands and agree the split before an incident.

Pre-authorised, low regret. Ending a suspicious back-office session, revoking a credential created minutes ago, blocking an address at the edge, forcing a reset on an operator account, taking evidence snapshots.
Pre-authorised with notification. Suspending a service account that is writing to ticket or prize tables, restricting a manual-adjustment role. Do it, then tell the data or finance owner immediately.
Draw-owner decision only. Holding or amending a result, repeating or annulling a draw, pausing or reversing payouts, reopening sales, communicating a delay to players. Responders recommend and supply evidence; a named draw-operations owner decides, with compliance where your licence requires.

Name the people, their deputies, the contact routes and the maximum time to reach each one. If nobody can be reached, the default is to preserve evidence and contain accounts, not to alter the draw.

Regulators, players and vendors

Lottery licences often carry obligations about notifying the authority, retaining records and communicating with players. This article does not state what any authority requires; check your licence terms and local rules, and put the notification owner and route into the runbook so responders know whom to hand information to. Keep the customer-facing statement a draw-operations and legal decision, written from confirmed facts. For vendors, confirm in the contract how quickly they must notify you, which logs they will release and whether their responders will join your incident call.

What to put in the retainer

A retainer that suits a lottery should state, in plain terms:

the response clock, meaning time to first human response and time to join a call, including during draw windows;
access to ticket, draw-workflow, result and payout logs, and how vendor-held logs are requested;
the escalation contacts on both sides, including a draw-operations owner reachable during every draw;
what responders will not do without written instruction, in particular changing draws, results or winner lists;
how evidence is sealed and handed back, including custody records.

For the general shape of response clocks, hours and exclusions, read what an incident response retainer quote must say. Run a tabletop that starts mid-draw before you need the real thing; tabletop scenarios and roles shows how to structure one.

Limitations

This article is not legal or regulatory advice and does not state what any licensing authority requires of a lottery operator regarding notification, draw supervision, record retention or player communication. It uses no external statistics or incident case studies. The decision table is a design hypothesis to adapt to your own platform, schedule and staff, and it does not replace a response plan agreed with your compliance and legal advisers. An outsourced draw or retailer system may expose far fewer logs than a self-hosted one; confirm access with the provider. Incident response does not certify a draw or random number generation, and it cannot guarantee that an attacker will be identified or that all evidence will be recoverable.

Decision and next step

If you can name who may hold a result, who is on call for each draw window and where the ticket set, draw log and winner list are snapshotted, you are ready to agree a retainer. If you cannot, the decision owners, the evidence list and the three authority bands are the first things to write down. Get an IR retainer from AnySec and we will map your draw cycle to a response plan and name the escalation owners with you.

Sources and review

Process structure follows public guidance: the NIST SP 800-61 Computer Security Incident Handling Guide and the NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response, read 2026-11-10; check the current versions. AnySec prepared the lottery-specific decision table from the public structure of lottery operations; no AnySec-original statistics are used. Author: AnySec Engineering. Published 2026-11-10; reviewed by the AnySec security team.

Frequently asked questions

Who should decide whether to hold a result or pause payouts during a security incident?: A named draw-operations owner, with finance and compliance alongside, decides. Responders recommend based on what they can show was touched, preserve evidence and contain accounts and credentials, but they do not alter a draw or a result on their own. Write the names, the contact routes and the maximum time to reach each person into the runbook before the first draw.
What is the first thing to preserve when a ticket or result tampering is suspected?: The frozen ticket set and the result pipeline state, exactly as they are. Export or snapshot ticket tables, the freeze-job record, the draw workflow log, the current and previous result values and the winner list before anyone repairs or regenerates anything. Record who took each snapshot, when, and where it is stored.
How is a lottery incident different from an online casino incident?: Value is concentrated in a few irreversible, time-fixed events: the sales cutoff, the draw, the result release and the payout. A casino incident is usually about accounts, cashier flows and platform availability. A lottery incident can also be about whether a ticket set, a result or a winner list was altered, which makes evidence ordering and decision ownership more important than speed of repair.
Can an incident response team certify that a draw was fair?: No. Random number generation and draw certification are assessed through separate laboratory or regulator-defined processes. Responders can establish who accessed and changed the systems around the draw and what the logs show, and that evidence can support the people who do make a fairness or validity decision.
What should a lottery operator's incident response retainer say?: It should name the response clock, escalation contacts on both sides, and access to ticket, draw-workflow, result and payout logs, including those held by vendors. It should also say how responders join a call with draw operations while a draw window is open, and what they will not do without the operator's written instruction.