F500 Entertainment & Leisure · Hotels, Casinos, Resorts · Structural / no discrete incident
Caesars Entertainment
Headline
Caesars was breached in 2023 through social engineering of an outsourced IT support vendor, and reporting indicates Caesars paid a substantial ransom while MGM did not - two competitors, same period, same technique…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Caesars was breached in 2023 through social engineering of an outsourced IT support vendor, and reporting indicates Caesars paid a substantial ransom while MGM did not - two competitors, same period, same technique, opposite decisions, and neither set of customers had any say. The Caesars Rewards database exposed in that incident contained loyalty data including driver's licence and Social Security numbers for a large number of members. Casino loyalty data is a gambling-behaviour record.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual guest/rewards-program agreements.
Data sharing
CONFIRMED 2023 BREACH via a SOCIAL ENGINEERING attack on an OUTSOURCED IT SUPPORT VENDOR (per Caesars' Sept. 14, 2023 Form 8-K), shortly before the related MGM Resorts attack documented in this same tab; both were attributed in reporting to the Scattered Spider group: hackers stole Caesars' REWARDS-PROGRAM MEMBER DATABASE. Unlike MGM, Caesars REPORTEDLY PAID A RANSOM (reported as $15 million of a $30 million demand) to the attackers specifically to protect customer data from being publicly leaked — a real-world illustration of the 'pay to avoid disclosure' strategy, in contrast to MGM's refusal (documented in that row) which led to a more prolonged, publicly visible operational disruption. The Nevada Gaming Control Board and Nevada's governor were reported to be actively monitoring the situation given the coordinated, industry-targeted nature of both attacks.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy caesars.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service caesars.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.