The fish tank sat in the lobby maintaining water chemistry while stealing credit card numbers. The casino isolated the fish tank on its own VPN. Separate network. Segregated. Off limits to everything. Hackers didn't care. Broke through ....

X.com ^ | October 19, 2026 | Abdulkadir | Cybersecurity @cyber_razz

[ransomnote]

Abdulkadir | Cybersecurity
@cyber_razz
A casino installed a smart fish tank in the lobby.

Beautiful thing. Automated feeding. Temperature control. Remote monitoring.

Connected to the internet. Obviously.

Hackers found it.

Exploited it.

Downloaded the high-roller database.

10 gigabytes.

Sent it to Finland.

Using audio and video protocols so it looked like normal streaming traffic.

The fish tank sat in the lobby maintaining water chemistry while stealing credit card numbers.

The casino isolated the fish tank on its own VPN.

Separate network. Segregated. Off limits to everything.

Hackers didn't care. Broke through the isolation anyway.

Once inside the fish tank's system. They pivoted to the main network.

Quietly pulled data. Methodically.

10 gigabytes over time so nobody noticed.

Nobody monitors fish tank outbound traffic.

Why would they.

It's a fish tank.

When Darktrace finally investigated they saw it immediately.

The fish tank sending massive amounts of data to an external IP.

Using protocols designed for audio. Not data.

Clear exfiltration.

The only device in the entire casino that ever communicated with that Finland server.

A fish tank.

Not a computer. Not compromised credentials. Not a malware-laden email.

A networked aquarium.

The lesson everyone learned: IoT devices are security theater.

You can secure them. Lock them down. Isolate them.

They're still connected to something. Still vulnerable to something.

And something will find them.

Even if that something is just checking if a fish tank is running the default password.

 

Abdulkadir | Cybersecurity

 

@cyber_razz

·

40m

 

Btw this story is 100% real. Articles to read more on it:

https://helpnetsecurity.com/2017/07/27/internet-connected-fish-tank-hackers/

https://pcnetworked.com/the-fish-tank-

 

---

TOPICS: Miscellaneous
KEYWORDS: finland; xpam

[paulcissa]

IoT devices are an open-air crack market for bad actors. Less is more. Air-gap everywhere.

[Magnum44]

[butlerweave]

Ocean’s Gotcha

[oldskoolwargamer2]

Sounds like a bullshit story from someone trying to sell security software or services.

[oldskoolwargamer2]

Sounds like a bullshit story from someone trying to sell security software or services.

[Red Badger]

[Red Badger]

Gambling Fish Ping!..................

[jimtorr]

Hackers have been exfiltrating data for a long, long time.

Twenty years ago I was working for a major DOD contractor in Maryland, across the parkway from NSA HQ. Corporate IT security discovered a data leak sending large amounts of data from corporate HQ to somewhere in China.

To make matters more interesting (and amusing), they were using the local IT security managers computer to do it. Just two cubicles over from mine.

You can bet that NSA was all over the leak after it was discovered. The IT security computer was picked up by NSA agents and never seen again.

[Wally_Kalbacken]

Well, maybe.

I just got a warning that the U.S. Bankruptcy Court’s notice system was hacked and will be down for a week. I cannot understand why someone would target that; it is information queued as documents for mailing. Images of documents that are being mailed to creditors, law firms, debtors, etc. All information in the public domain, not sealed documents. Why would anyone hack that? Perhaps it gives them a back door or side door to more important things.

In the meantime - a massive pain in the posterior.

[jacknhoo]

And what’s in our voting machines.

[Mogger]

Sounds like a bullshit story from someone trying to sell security software or services.

Could be, also repetitive AI slop story.

I like AI for research and antenna design.

So far AI writes horrible messes to attempt to read.

[jacknhoo]

I also do antenna design. AI has been helpful in that respect. Mostly saving time in what used to take me a few days now taking an hour or two to develop some aspects. But it also coughs up some BS too. It’s like anything else, you have to know your discipline to spot the BS.

My hunch seeing you’ve mentioned NH is Cobham.

I’m in Georgia.

[MikelTackNailer]

And what’s in our voting machines.

Exactly why I want everyone possible to use their phones, bodycams, whatever to record as much as they can of their voting experience - most importantly the machine's identifying numbers wherever they're placed on the units.

Note any docking ports for USB or other media access. If you can plug something into it anyone else can in seconds.

[Presbyterian Reporter]

I note all of the positive hype about the benefits of AI.

However, I also note that those hyping AI remain silent about the bad dudes who smartly use the AI to commit crimes.

Cops and Robbers was such a much simpler childhood game 60 years ago.

[frogjerk]

Bingo! The way it was written was a tip off.

[mewzilla]

Not AI, guys...

https://www.forbes.com/sites/leemathews/2017/07/27/criminals-hacked-a-fish-tank-to-steal-data-from-a-casino/

But the story is 9 years old.

[Organic Panic]

I am a huge fan of AI. I set up a shopping and menu bot for my elderly mum. I can upload blood work to help plan the diet too. For myself I use it for coding PLCs and other motion control processes. What took me days AI does in minutes. I started playing around with Autodesk’s AI design platform. It makes some pretty cool designs BUT nothing that can be manufactured... easily. Not bad for $20 a month. (Autodesk is 2000 a year but I get it free as a beta tester since the late 90s. I found every bug they could plug in to it.). A few weeks ago I needed a kanban board and all I had to do was tell grok “make me a kanban board to track these parts) and in a few minutes I had a completed system set up for parts tracking.

I can’t wait for ai to take over my book keeping.

[Organic Panic]

HENCE the blue states quest for universal mail in voting. Can’t prove the fraud when no one witnesses it.

[Mariner]

This is what firewalls and Intrusion Detection were e built for.

Fire the IT director.