What makes a sportsbook security incident different from an online casino incident?

A sportsbook has a trading side. Prices change constantly, bets are accepted against those prices, and results are settled after real-world events. An incident can therefore require business decisions a casino rarely faces: suspending markets, pausing settlement and deciding which accepted bets to void or keep. Those decisions belong to trading and finance, not to the security team alone.

Who should be allowed to suspend markets during an incident?

Name the role in advance, usually a head of trading or a duty trader, and give security a direct line to them. Engineers should not guess which markets to close. The security team's job is to say what is suspected to be compromised; the trading team decides what exposure to stop taking.

Should we void bets as soon as we suspect feed tampering?

Not automatically. Voiding is a customer-facing and often rule-bound decision. First preserve the evidence of what was accepted, at what price and when, then let trading, legal and compliance decide. Check your own terms and your licensing conditions; this article does not state what any regulator requires.

What evidence is easy to lose in a sportsbook incident?

Price and feed history at the moment bets were accepted, bet-acceptance and cash-out logs, back-office audit trails for limit and settlement changes, and the exact times markets were suspended or reopened. Short-retention logs and overwritten price state are the usual losses, so export them before restoring service.

What should an incident response retainer for a sportsbook say?

It should name the response clock, the escalation contacts on both sides, access to trading and back-office logs, and who joins a call with trading. Ask for a pre-agreed way to work alongside the trading team during live events, and for evidence-handling steps that survive a dispute with customers or a regulator.

Incident Response for a Sportsbook: Suspending Markets, Voiding Bets, and Preserving Evidence

The short answer

When a sportsbook is compromised, the first hour is shaped by decisions a casino does not usually face: whether to suspend markets, whether to freeze settlement and cash-out, and which accepted bets to hold, void or honour. Security can contain the intrusion, but only trading and finance can decide what exposure to stop taking. So prepare three things before an incident: a named trading owner with authority to suspend, a short list of evidence to export before anything is restored, and a retainer that says how responders work with the trading desk during live events. The service behind this is incident response.

Who this is for

This is for a Head of Security, CTO, Head of Trading or COO at a sportsbook or betting operator who has a generic incident plan and suspects it does not say what happens to open markets and accepted bets. For the general casino case, including ransomware, see ransomware response for an online casino; for the retainer terms themselves, see incident response retainers for online casinos. This article covers only what a sportsbook adds.

What a sportsbook adds to the first hours

A generic plan asks: what is compromised, can we contain it, who must be told. A sportsbook plan has three further questions.

What are we still accepting? If pricing, feed ingestion or bet acceptance might be affected, every minute of continued acceptance may add exposure that trading will later have to carry or contest.
What is settling? Settlement and cash-out move money based on results and prices. If an attacker, or a bug, can influence them, pausing them stops the damage compounding.
What happened to the bets already accepted? Whether any should be voided or honoured is a rule-bound business decision, and it depends on what the evidence shows.

Who decides what

Write the split down. Security recommends; the business decides.

Decision	Usual owner	Security's input
Suspend one market, a sport or all markets	Head of trading or duty trader	Which feed, price or acceptance path is suspected
Pause cash-out or settlement	Trading with finance	Whether ledger or settlement tooling may be affected
Suspend deposits and withdrawals	Payments owner	Whether cashier or provider credentials may be exposed
Void or keep affected bets	Trading, legal and compliance together	What the logs show was accepted, at what price and when
Notify a regulator or payment partner	Compliance or legal	Facts and timeline, once known
Contain hosts, rotate credentials, revoke access	Security and engineering	Everything

If the decision-maker is on a flight or off shift, the plan must name a deputy. A plan that depends on one person is not a plan for a live event.

Evidence to export before restoring service

Restoring service often overwrites the state you need. Before bringing back a market, a feed or a trader tool, export:

Price and feed history around the suspected window, as the platform saw it, including the source of each update.
Bet-acceptance and cash-out logs, with timestamps, the price accepted and the account involved.
Back-office audit trails for limit, margin, pricing and settlement changes, and for logins to trader tools.
Market state changes: when each market was suspended or reopened, and by whom.
Authentication and access logs for trader, support and API roles.

Keep copies read-only and record who exported them and when. Short log retention is the most common loss, which is a good reason to settle retention before an incident, not during one. The structure of what responders should hand back is similar to what a real pentest report looks like: a timeline, evidence per claim and plain statements of what is not known.

Working with the trading desk during live events

Responders who have never seen a trading desk can lose time asking what normal looks like. Prepare a one-page briefing for responders: which systems price and accept bets, which roles can change limits or settle, which dashboards show unusual activity, and who to call. Agree a single bridge where security and trading both sit, so market decisions and containment steps are not made in separate rooms.

What the retainer should say

A retainer for a sportsbook should cover what a generic one omits. See incident response retainer quotes: hours, overage and response clock for the commercial terms, and add:

Access to trading and back-office logs for responders, with the approvals needed in advance.
Named contacts on both sides, including the trading deputy.
A stated way of working alongside trading during live events.
Evidence-handling steps that would stand up to a dispute with customers or a regulator.

Rehearse the call sequence with a tabletop exercise that includes a trading scenario.

Limitations

This article is not legal, licensing or compliance advice and does not say what any regulator requires, including notification duties or rules on voiding bets. It names no statistics. Terms and licence conditions differ by operator and jurisdiction; confirm them with your own legal and compliance contacts.

Decision and next step

If you can name the person who may suspend markets, the deputy, and the five log sources above, your plan is ahead of most. If not, that gap is the first thing to close. Get an incident response retainer scoped around your trading and back-office systems, and we will reply with a fixed quote and rules of engagement.

Sources and review

No external statistics or regulatory claims are used. Author: AnySec Engineering. Published 2026-10-23; last reviewed 2026-10-23.