How an infosec director at Multi-State Lottery Association spoofed random number generator software and almost pulled off the largest lottery scam in US history
The file landed on Rob Sand's desk with something less than a thud. Despite holding the contents of an investigation still open … Tweets: @briankrebs , @rlove , and @reidforgrave Tweets: @briankrebs : When the Iowa attorney general's office began investigating an unclaimed lottery ticket worth millions, an incredible string of unlikely winners came to light - and a trail that pointed to an inside job. http://www.nytimes.com/... good read Robert Love / @rlove : True crime involving random number generators. http://www.nytimes.com/... Reid Forgrave / @reidforgrave : A $16.5 million lottery ticket, but the winner refused to reveal his identity. Why? “A classic story about an inside job...with a 21st century twist.” I wrote on the biggest lottery scam in US history for @NYTmag: http://www.nytimes.com/...
Context & Ripple Effects
This is the insider chapter of a story the corpus has been telling from the outside for years. In 2017, Wired reported on a Russian team reverse-engineering slot machine pseudorandom generators and sending agents into casinos to beat the odds; Bloomberg has since catalogued decades of computer-assisted roulette-beating tech, and the DOJ's 2025 rigged-poker indictment charged hackers who compromised DeckMate card shufflers to see players' hands. What the New York Times adds is that the most dangerous attacker wasn't outside the machine at all — he was the infosec director responsible for securing it.
The trail began when the Iowa attorney general's office, with investigator Rob Sand, dug into an unclaimed multi-million-dollar ticket and found a string of unlikely winners pointing back inside the Multi-State Lottery Association itself. The scam failed not because the RNG spoof was detected in real time but because the winning pattern was too improbable to ignore.
First-order effects
- The Multi-State Lottery Association's own security leadership becomes the breach: an infosec director with privileged access to the number-drawing software could spoof outcomes, meaning the association's controls failed precisely where they were supposed to be strongest.
- Iowa's attorney general office gains a template case — an unclaimed-ticket audit that turned a routine inquiry into exposure of a multi-state insider scheme, establishing post-hoc statistical review as a detection mechanism.
Second-order effects
- Lottery and casino operators face pressure to treat their own security staff and software vendors as threat actors, adding segregation-of-duties and independent verification layers that raise operating costs across the gambling industry.
- Hardware and software suppliers to gambling — RNG providers, shuffler makers like DeckMate — inherit a trust problem: after the hacked-shuffler poker indictment and this insider RNG spoof, buyers must demand attestations that the randomness itself hasn't been tampered with.
Third-order effects
- Across slots, roulette, poker, and now lotteries, the consistent lesson is that attacks target the source of randomness rather than the game — pushing the industry toward auditable, independently verifiable draw systems as a structural requirement rather than a differentiator.
- If improbable-outcome audits become standard practice, insider fraud in games of chance shifts from 'undetectable' to 'statistically conspicuous,' changing the risk calculus for anyone with privileged access to drawing or dealing systems.
The trend: Gambling's attack surface is migrating from beating the odds at the table to corrupting the machines and insiders that generate randomness, forcing the industry to verify its own infrastructure.