The fish tank did not care about network security. In 2017, an internet-connected aquarium device in an unnamed casino’s lobby reportedly served as the entry point for a corporate breach, resulting in roughly 10 GB of stolen data routed to a server in Finland.
The stolen information reportedly included a database of high-roller customers, according to accounts from the cybersecurity firm Darktrace. If a decorative lobby fixture can become a network liability, so can the smart thermostat or the HVAC controller three floors down.
How a Lobby Aquarium Became a Network Liability
The case shows how an ordinary connected device can hand attackers a path into systems that have nothing to do with fish.
The aquarium was connected to the internet, reportedly allowing remote monitoring or management of temperature and general tank conditions. Attackers reportedly used the compromised device to move laterally into other parts of the network, where they located the high-roller database.
Nicole Eagan, then CEO of Darktrace, disclosed the incident publicly at a Wall Street Journal CEO Council event in London in April 2018. She described attackers gaining a foothold through the aquarium device and locating the high-roller database. They then pulled the data back out through the thermostat and into the cloud, according to reporting at the time.
The casino was never publicly identified, and the attackers’ identities remain unknown. Some technical details, including claims that outbound traffic was disguised to resemble audio or video streaming, are inconsistently documented across available sources and should be treated with caution.
The Real Lesson Has Nothing to Do With Fish
Network segmentation is a meaningful control, but it is not an unconditional guarantee.
The aquarium reportedly sat behind a separate network arrangement intended to isolate it from the casino’s main systems. The breach reportedly occurred anyway, which is the point worth understanding.
Misconfigured routes, excessive permissions, or undocumented communication paths can still allow lateral movement, even when a device looks safely quarantined on paper. Think of it like adding a guest to your Wi-Fi network and forgetting that your shared drive is still visible to everyone on it.
Darktrace noted that IoT devices, including thermostats, refrigeration systems, HVAC controls, and voice assistants, frequently fall outside traditional security monitoring. That gap means connected devices can sit on corporate networks with little oversight, creating blind spots that attackers can exploit.
Who Actually Bears the Risk
Casino operators are the obvious example here, but the exposure extends to any organization running connected building systems alongside sensitive databases.
IT and security teams responsible for unmanaged or shadow-IT devices are directly implicated. Customers whose personal information ends up in a high-roller database had no say in how the aquarium was configured or secured.
What Organizations Should Do With This
The controls are straightforward; the challenge is applying them consistently to every device on the network, not just the obvious ones.
Security teams should log every connected device before it touches the network. Default credentials need changing before deployment, firmware updates need a maintenance schedule, and outbound connections from IoT devices need active restrictions and monitoring.
Teams should verify network segmentation through live traffic testing, not assumed configuration. The attack surface of any network now includes whatever is connected devices plugged into it, decorative or otherwise.
