Caesars Entertainment Hit with Class Action Over August 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges potentially millions of current and former Caesars rewards program customers had their personal information exposed in an August 2023 data breach the casino giant failed to prevent.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the 39-page case, defendant Caesars Entertainment revealed on September 14 of this year in an 8-K filing with the U.S. Securities and Exchange Commission (SEC) that an unauthorized actor had gained access to its loyalty program database. A “significant number” of Caesars’ 65 million loyalty program members are believed to have been impacted by the digital break-in, the form states.

The complaint says the cyberattack—which reportedly occurred around August 23, 2023—exposed consumers’ names, mailing addresses, telephone numbers, email addresses, dates of birth, driver’s license numbers and Social Security numbers. Consequently, those affected by the breach now face a lifetime risk of identity theft and must pay out of pocket for services to help prevent, detect and recover from any fraudulent use of their private data, the suit stresses.

The lawsuit claims the incident stemmed from the company’s failure to properly safeguard consumer information by following “applicable, required, and appropriate” protocols concerning data security. Per the suit, Caesars “negligently” stored customers’ unencrypted data in an “Internet-accessible environment.”

Although the defendant admitted in its SEC filing that it learned of the cyberattack on September 7, it waited until October 11 to inform victims that their data had been stolen, the case shares. In fact, Caesars even admitted in its notice letter that after detecting suspicious activity on its network, it launched an ongoing investigation, sought assistance from leading cybersecurity firms and alerted law enforcement and state gaming regulators, all before it began notifying those whose information was compromised, the filing charges.

“In other words, [Caesars] prioritized informing investors over conveying time-sensitive information to victims,” the case contends.

Caesars’ notice of the breach to the Maine Attorney General discloses that the company’s network was hacked after it fell victim to a “social engineering attack” on an outsourced IT support vendor.

“Social engineering is a form of hacking whereby a data thief uses previously acquired information to manipulate and trick individuals into disclosing additional confidential or personal information through spam phone calls, text messages or phishing emails,” the filing explains.

It’s been reported that Scattered Spider, a notorious cybercriminal group, may have been responsible for both the Caesars data breach and a September 2023 cyberattack against casino giant MGM, the complaint relays. Caesars has reportedly paid roughly half of the hacker group’s $30 million ransom demand after the cybercriminals threatened to leak the stolen data online, the suit says.

The lawsuit looks to represent anyone whose personal information was compromised in the data breach experienced by Caesars Entertainment beginning on or around August 23, 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.