Caesars Entertainment Breach (2023): A Vendor Help-Desk Call and a Reported $15M Ransom

On this page: How the attack worked · Timeline · What was stolen · Caesars vs MGM · What would have stopped it · Common questions

How the Caesars breach started: one call to the service desk

Caesars' own Form 8-K says very little. The intrusion came from "a social engineering attack on an outsourced IT support vendor," and that's it. The step-by-step version comes from later filings in the Nevada federal class action. Those are allegations. So far the court has only decided the claims can proceed. Whether they're true is another matter.

1. Reconnaissance. Somehow the attackers knew enough about a real Caesars employee to pass as them on the phone. How they got that, no filing says.
2. Pretext and first contact. Someone called the IT service desk that Coforge, Inc. (formerly NIIT Technologies) ran for Caesars under a statement of work. Coforge staff handled password resets and account unlocks, partly from a service desk in Las Vegas. That makes this vishing aimed at a help desk. It's also supply-chain social engineering, since the vendor was the way in.
3. Access. The amended complaint against Coforge says staff reset the password and bypassed multi-factor authentication (MFA) settings without verifying who was calling. Everything after depended on that one reset, the account takeover.
4. Escalation and movement. Logged in as a real employee, the attackers moved through Caesars' identity and IT systems. The Coforge complaint says they were in the network for five days without being caught.
5. Exfiltration. On or around August 23, 2023, they copied the Caesars Rewards loyalty database. It held driver's license and/or Social Security numbers.
6. Extortion. They threatened to publish the data and asked for $30 million, according to press reports that the complaint repeats.

Nowhere in the public record is there a phishing link, a malicious attachment or a software exploit. The help desk took a caller at their word, and that was enough. It's why SEE files this case under help-desk and MFA manipulation.

Caesars breach timeline

What was stolen in the Caesars breach, and what the $15 million figure rests on

Caesars said what was taken. It never said what it paid. Here are the two side by side, with where each item comes from.

The 8-K says Caesars took steps to get the stolen data deleted but "cannot guarantee this result." That's as close as the filing gets to describing a negotiation with the attackers.

Caesars reportedly paid, MGM refused: same crew, weeks apart

Caesars and MGM Resorts both got help-desk calls in late summer 2023, and both are attributed to Scattered Spider. Clorox reported a third case that August, through a different outsourced help desk. Put them next to each other and the pattern's obvious. The target changed. The reset request didn't.

This isn't a clean test of whether paying works. Caesars' data was already gone and its casinos were open, while MGM was dealing with an outage. What the cases do show is how wide the exposure is. It covers every help desk, in-house or contracted, that can reset a company's staff logins.

The control that failed: a reset with no identity check

Everything hinged on step three. Had the service desk refused the reset until the caller proved who they were, the attackers would've had nothing to build on.

• At the reset (steps 2 and 3): check callers with something an impostor can't look up. A callback to a number already on file works, or sign-off from the employee's manager, or an in-person or video check. Questions with searchable answers, like an employee ID or a manager's name, don't help much.
• At re-enrollment (step 3): if MFA really does need resetting, move the user to phishing-resistant MFA, a FIDO2 security key for instance, rather than a texted code.
• After the reset (step 4): a password or MFA reset followed by a login from a new device or place should set off an alert. Hold off on privileged access until the real user confirms the change.
• At the data (step 5): keep less full Social Security and license data in a loyalty system, and watch for big exports from it.

Caesars' 8-K says the vendor has since "implemented corrective measures." It doesn't say what those were.

Lessons for help desks, vendor managers, and security teams

Help-desk and service-desk leads

The reset request that sounds routine is the attack. Write a verification script staff can't skip when they're under pressure, and make it clear they're allowed to say no.

Vendor and procurement managers

Coforge's statement of work covered security standards. The complaint still says no identity check took place. Contracts should spell out how resets get verified, and give you the right to test it.

Security teams

Anyone who can reset your staff's credentials has privileged access, so monitor them that way. Caesars caught the activity early and still lost the data.

Trainers

Test the help desk itself with social engineering, outsourced staff included. Don't just test the end users who get phishing emails.

What is still unresolved

• Attribution: on Sept. 14, 2023 a Scattered Spider spokesperson said the group wasn't involved. Bloomberg, the plaintiffs and the court's order summing up their claims name it anyway. No criminal charge links anyone to Caesars.
• The payment: no Caesars filing confirms it paid, or how much.
• The data: Caesars said it couldn't guarantee deletion, and the litigation hasn't finished.

Caesars breach: common questions

Reviewed by the SEE Team. This case was written from the filings and reports listed below and checked against them before release. See how cases are sourced and reviewed and who runs this library.