Two Kings Casino Resort Listed by anubis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Two Kings Casino Resort was listed on April 23, 2025, by the ransomware group known as anubis. The group claims it carried out a ransomware attack that involved the exfiltration of internal files, including ultra-detailed blueprints of a casino facility planned for a grand opening in 2026. The number of people affected remains unknown, and public detail on the precise timing, method, or full scope of the incident is limited.

This matters because casino blueprints can reveal physical layouts, security features, and operational infrastructure. Even without confirmed personal data exposure, such material can create lasting risks for the organisation and anyone whose information may have been stored alongside the files.

What happened

According to the reported listing, anubis claimed responsibility for a ransomware attack against Two Kings Casino Resort and stated that internal files had been exfiltrated. The only concrete description available is that the material includes ultra-detailed blueprints of a casino scheduled to open in 2026. No confirmed date for the initial intrusion, no figure for the volume of data taken, and no technical description of the attack method have been made public. The number of individuals whose information may have been involved is listed as unknown. The listing itself constitutes a claim by the group rather than an independently verified confirmation of every detail.

Who is anubis?

Anubis is a ransomware operation that has appeared in public reporting as a group that conducts double-extortion attacks: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. Like other groups of this type, anubis maintains a leak site where it posts victim names and sample files to increase pressure. Public records of its activity show a pattern of targeting organisations across multiple sectors, often advertising large data volumes and sensitive internal documents. The group’s listing of Two Kings Casino Resort follows this established pattern; any specific assertions about the volume or content of the stolen material beyond the published claim of internal files and blueprints remain unverified claims.

Who is Two Kings Casino Resort?

Two Kings Casino Resort is a hospitality and gaming organisation preparing a casino property for a grand opening in 2026. Entities of this kind typically manage guest reservations, loyalty programmes, payment processing, employee records, surveillance systems, and detailed architectural and security plans. Blueprints and related internal files are especially sensitive because they can disclose physical access points, camera placements, vault or cage locations, and other security architecture. A breach involving such material is consequential because it can undermine both physical security planning and competitive confidentiality long before the facility opens to the public.

What data was at risk

The only data types named in the available facts are internal files exfiltrated during the claimed ransomware attack, specifically ultra-detailed blueprints of the planned casino. No further inventory of file types, databases, or personal records has been disclosed. Organisations in the casino and resort sector commonly hold guest contact and payment information, employee personnel files, vendor contracts, and security documentation. Because the exact contents of the exfiltrated set remain unconfirmed beyond the blueprints claim, it is not possible to state with certainty whether personal data of guests or staff was included.

What's at stake

For the organisation, the release of detailed blueprints can expose physical vulnerabilities that adversaries might later exploit, complicate insurance and regulatory discussions, and damage relationships with future partners or regulators. For any individuals whose data may have been present in the same internal systems, the usual risks of identity fraud, phishing, or account takeover apply if personal identifiers were among the files. Because the number of people affected is unknown and the full data inventory is undisclosed, the precise scale of personal impact cannot yet be measured. The primary confirmed exposure remains the architectural and operational detail of a facility still under development.

If your data was in this claimed breach

If you have any past or planned connection to Two Kings Casino Resort—as a prospective guest, employee, contractor, or vendor—treat the possibility of exposure seriously even while details remain limited. Practical first steps include:

• Monitor financial and loyalty accounts for unexpected activity and enable multi-factor authentication wherever available.
• Be alert to phishing messages that reference casino openings, reservations, or security updates; verify any such contact through official channels only.
• Consider placing a fraud alert or credit freeze if you believe sensitive personal identifiers may have been stored with the organisation.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in public dumps.

Public reporting on this incident is still thin. Continue to watch for official statements from Two Kings Casino Resort or law-enforcement updates that may clarify what was taken and who is affected. Until then, the safest course is measured vigilance rather than assumption that personal data was or was not involved.

AICompiled with AI assistance from public sources and published under our editorial standards.