Caesars Entertainment Scattered Spider ransom payment (2023)

In August 2023, Caesars Entertainment — one of the largest U.S. casino and hospitality operators — was breached by Scattered Spider through a phone call to a third-party IT support vendor. The attackers exfiltrated customer loyalty data including Social Security numbers and driver's licences, and within weeks Caesars paid approximately $15 million in cryptocurrency to keep the data from being published. The case is also a rare counter-example: the FBI, using Chainalysis tooling, froze a substantial portion of the ransom on the blockchain after Caesars paid.

What happened

Scattered Spider's playbook by 2023 was well-rehearsed: identify a third-party IT support vendor with privileged access to the target's identity systems, social-engineer the vendor into resetting credentials or granting access, and ride that access into the customer environment. At Caesars, the attackers impersonated a Caesars employee on a call to the vendor and obtained credentials for Caesars' Okta access-management platform.

By 23 August 2023, they had reached the customer loyalty database — which contained Social Security numbers and driver's licence information for tens of millions of guests. The attackers exfiltrated the data and demanded $30 million. Caesars negotiated and paid approximately $15 million in cryptocurrency to forestall public release.

Caesars disclosed the incident in an SEC filing on 14 September 2023 — making it one of the first U.S. public-company filings to explicitly state that a ransomware payment had been made. (The same Scattered Spider crew hit MGM Resorts at almost exactly the same time; MGM refused to pay and absorbed roughly $100M in operational losses.)

The FBI, in collaboration with Chainalysis, traced the ransom on the blockchain and froze a substantial portion of the funds — a rare publicised counter-example to the usual narrative that crypto ransom payments are unrecoverable.

Impact

• Customer loyalty data including SSNs and driver's licences exfiltrated.
• ~$15 million ransom paid (down from a $30M demand).
• First high-profile SEC-filing disclosure of a ransomware payment by a major U.S. casino.
• FBI and Chainalysis traced and froze a substantial portion of the paid ransom.

Why it matters

Caesars is the contemporary reference case for two things: social-engineering of third-party IT support as the dominant initial-access vector for high-value targets, and blockchain-recovery as a real (if uncertain) post-payment outcome. The pairing with MGM Resorts — same crew, same week, opposite decisions — gave U.S. boards their cleanest possible side-by-side comparison of pay vs. refuse.