Caesars Entertainment reports theft of its loyalty program database after a vendor social engineering attack

Caesars Entertainment disclosed on September 14, 2023 that suspicious activity in its IT network had resulted from a social engineering attack on an outsourced IT support vendor. On September 7 it determined that the intruder had copied its loyalty program database, which includes driver's licence numbers and Social Security numbers for a significant number of members.

What Caesars reported

Casinos and online and mobile gaming were not affected. The data finding came a week before the filing.

Caesars said it had no evidence that passwords, PINs, bank account or payment card data were taken. It said it had taken steps to ensure the stolen data was deleted, while acknowledging it could not guarantee that, and offered credit monitoring to all loyalty members.

Materiality and gaps

Caesars did not expect a material financial effect. The filing does not give the number of members affected, name the vendor, or date the start of the intrusion.