Caesars Entertainment

Caesars was breached weeks before MGM, but unlike MGM the attack vector ran through an outsourced IT support vendor rather than Caesars' own help desk. Reporting indicates the operators social-engineered the third party, then pivoted into Caesars' environment using that relationship.

The operators obtained Caesars Rewards loyalty-program data including driver's license numbers and Social Security numbers for “a significant number” of program members. The breach was disclosed in an SEC 8-K filing on September 7, 2023, three days before MGM's intrusion became publicly known.

Multiple outlets including Bloomberg and the Wall Street Journal reported that Caesars paid approximately $15 million of an initial $30 million ransom demand. Caesars kept its consumer-facing operations running through the incident, which several analysts attributed to the decision to pay.

The Caesars chain illustrates a risk small businesses share with megacorps: your security perimeter ends at the worst-trained person at any vendor you rely on. The Caesars employees did not click a phishing link. The Caesars help desk did not reset an MFA token. The attack succeeded somewhere outside the Caesars network.