HackingRetail & ConsumerHospitalityRetailSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)LowContained

CAESARS ENTERTAINMENT, INC.

bd_f8b5acb3346f154c · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 11, 2023

To disclose

—

Affected

Not disclosed

Linked

12 filings

Confidence

65%

Full breach record for CAESARS ENTERTAINMENT, INC. →5 incidents on file

Caesars Entertainment, Inc. disclosed a cybersecurity incident resulting from an attack on an IT support vendor. The breach window was August 23, 2023, to September 6, 2023. The incident impacted the company's loyalty program database, exposing customer names and other personal information. Caesars engaged cybersecurity firms, notified law enforcement, and offered two years of identity theft protection to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 23, 2023

Begins

Oct 11, 2023

Filed

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Hawaii State AGbd_4875e85583699d0e2023-10-11Verified
Massachusetts State AGbd_af0b8fc7aaaaff0f2023-10-11Verified
South Carolina State AGbd_b19c75ce2c69d4bd2023-10-12 · +1dVerified
Maine State AGbd_05c8c6491430b9e62023-10-06 · +5dVerified

Show 6 more filings ↓up to 7d gap

Washington State AGbd_272f94a6f3de2ba42023-10-06 · +5dVerified
New Hampshire State AGbd_3808f9e72f2d34c32023-10-06 · +5dVerified
Delaware State AGbd_69a1d6b1c88c08cd2023-10-06 · +5dVerified
Montana State AGbd_99384d40133c3f202023-10-06 · +5dVerified
Indiana State AGbd_c1415bc5d04e33312023-10-06 · +5dVerified
Oregon State AGbd_e9281b4209172a1f2023-10-18 · +7dVerified

Showing first 10 of 11 linked disclosures.

Name: CAESARS ENTERTAINMENT, INC.
norm: caesars entertainment

Name: CAESARS ENTERTAINMENT, INC.
norm: caesars entertainment
Industry: Retail & ConsumerllmHospitalityllm

Discovered: —
Breach occurred: Aug 23, 2023 – Sep 6, 2023
Materiality determined: —
Notification sent: Sep 14, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified law enforcementNotified state gaming regulators
Third party: via IT support vendor
Initial access: supply_chain

During the incident: Activated incident response protocols
Implemented containment and remediation measures
Launched an ongoing investigation
Engaged leading cybersecurity firms to assist
Notified law enforcement and state gaming regulators
Offering complimentary identity theft protection services for two years through IDX
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Maine State AGOct 6 · first

Washington State AGOct 6 · first

New Hampshire State AGOct 6 · first

Delaware State AGOct 6 · first

Montana State AGOct 6 · first

Indiana State AGOct 6 · first

Hawaii State AG+5d

Massachusetts State AG+5d

California State AG+5d · this page

South Carolina State AG+6d

Oregon State AG+12d

Pattern: first filing Oct 6 (ME), last Oct 18 (OR) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-574969
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 11, 2023
Raw hash: 54065244e5368ce7e7f0b1dde93b11ba24d03cab5b6b13f8b5f5dcca8ebca2c7

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityCAESARS ENTERTAINMENT, INC.

Victim entityCAESARS ENTERTAINMENT, INC.

IncidentThird-Party / Supply Chain

Stated responseActivated incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov