41,000 Mainers may have been hacked in ransom attack against casino giant

As many as 41,397 Maine residents may have lost personal information to a cyberattack that has hit the country's largest casino and hotel owner, Caesars Entertainment.

Names, driver's license numbers and Social Security numbers were shared with an unauthorized user who had acquired a copy of the company's loyalty program database, Caesars (Nasdaq: CZR) said in a Sept. 14 filing with the Securities and Exchange Commission.

The company, based in Reno and Las Vegas, Nev., notified the office of Maine Attorney General Aaron Frey on Friday.

The mandatory state notification included an estimate of how many Mainers could be affected by the data breach, but it's not clear how many other loyalty program members are at risk. In its filing, Caesars said private data was compromised "for a significant number of members in the database."

On Aug. 18, Caesars "was the victim of a social engineering attack on an outsourced IT support vendor" and data was copied sometime around Aug. 23, the company said.

"After detecting the suspicious activity, we quickly activated our incident response protocols and implemented a series of containment and remediation measures to reinforce the security of our information technology network. We also launched an investigation, engaged leading cybersecurity firms to assist, and notified law enforcement and state gaming regulators."

Loyalty program customers have been notified, and Caesars has said it does not believe their financial information was shared. An investigation is continuing. The company has released few details about the incident and did not immediately respond to questions from Mainebiz.

The Wall Street Journal, however, reported Sept. 14 that Caesars had paid roughly half of a $30 million ransom that the anonymous hackers demanded in exchange for a promise that they would not reveal stolen customer data. The attack came just days after another Nevada casino and hotel company, MGM Resorts, reported a massive data breach of its own.

The Caesars loyalty program offers discounts, services and amenities to patrons who frequent the company's more than 50 hotels and casinos in Nevada and 15 other states. The largest gaming company in the U.S. and one of the largest in the world, Caesars reported revenues of $10.8 billion last year.

In April, Caesars won a contract with three Maine tribes — the Maliseets, Mi’kmaqs and Penobscots — to operate their digital sports betting markets, the state's first, which are expected to go live next month.

Maine's two brick-and-mortar casinos, Oxford Casino in Oxford and Hollywood Casino in Bangor, are operated by Churchill Downs Inc. and PENN Entertainment, respectively.