Casino-based attacks aren't really because the casino has a lot of money around. 1) they have large, very detailed databases with extensive customer records (photos of drivers licenses, for example) that can are desirable on black markets 2) easy attack vector -- heavily dependent on a variety of vendor software and systems that are way out of date, run by weak, underpaid and often uninformed IT staffs unaware of some basic security vulnerabilities 3) being customer-facing and highly-regulated, casino companies are typically heavily incented to simply pay the ransom rather than face regulatory scrutiny and consumer distrust (and to restore cash flow, and because the soft IT teams probably didnt make comprehensive backups...)

I can imagine the galaxy-brain planning session where our perps are coming up with their next target. They rule out robbing international drug cartels and black-market arms dealers, because while those orgs do have a lot of cash on hand, they don't want to get on the wrong side of violent organised crime gangs.

...so they decide to hit casinos instead!

expanding-brain-starfield.gif