Caesars Entertainment loyalty database theft via IT support vendor
Caesars disclosed in a September 14, 2023 8-K that a social engineering attack on an outsourced IT support vendor gave an attacker access to its network, and that on September 7 it determined the loyalty program database had been taken. Caesars said it took steps to ensure the stolen data was deleted, wording TechTarget read as suggesting a ransom payment; Reuters and researchers reported Scattered Spider was behind the attack.
- Victim
- Caesars Entertainment
- Industry
- Gaming
- Country
- United States
- Intrusion began
- Aug 2023
- First disclosed
- Sep 14, 2023
- Actor
- Scattered Spider (UNC3944) (Extortion group)
- Initial access
- Help desk social engineering
- Identity control that failed
- Identity lifecycle
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Caesars did not disclose a ransom amount or incident cost.
The identity lesson
An outsourced help desk holds the same reset power as an internal one and needs the same verification standard, logging and alerting on resets for privileged accounts.
Go deeper on SWI
Sources
- Caesars Entertainment Form 8-K (Item 8.01, cybersecurity incident), US SEC, Sep 14, 2023
- Caesars Entertainment breached in social engineering attack, TechTarget, Sep 14, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- MGM Resorts help desk social engineering and ransomware 2023 · Help desk social engineering
- Marks & Spencer ransomware attack via impersonation of a third-party user 2025 · Help desk social engineering
- Help desk resets of Okta super administrator MFA at multiple customers 2023 · Help desk social engineering
- Clorox intrusion after outsourced help desk reset passwords and MFA 2023 · Help desk social engineering
Cite this record
SWI Community Team. (2026). Caesars Entertainment loyalty database theft via IT support vendor. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-caesars-it-vendor-social-engineering/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.