Caesars Entertainment is facing a class action lawsuit over alleged data breaches in 2023 and again earlier this year.
The company suffered a widely publicized security breach in September 2023. The lawsuit alleges the company has failed to correct security failures and again suffered a data hack in early 2026.
The plaintiff, Mark Huddleston, alleges his data was stolen by cybercriminals, but blames Caesars for failing to properly protect his personal information.
“Caesars disregarded the rights of Plaintiff and Class Members by negligently failing to implement reasonable measures to safeguard Private Information and by failing to take necessary steps to prevent unauthorized disclosure of that information,” says the complaint.
“Caesars’s woefully inadequate data security measures made the Data Breach a foreseeable, and even likely, consequence of its negligence.”
Huddleston is a resident of Texas and says he has been a Caesars Rewards member since 2007. He filed the lawsuit in the US District Court in Nevada, where Caesars is based.
Caesars Paid Ransom to Limit Damage of Hack
In 2023, Caesars reportedly paid a ransom of $15 million to hacker group Scattered Spider.
At the time, Caesars stated, “We have taken steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result. We are monitoring the web and have not seen any evidence that the data has been further shared, published, or otherwise misused.”
The lawsuit alleges that the breach exposed Huddleston and others similarly situated to “threats of identity theft crimes, fraud, scams, and other misuses of their Private Information.”
It says the lawsuit qualifies as a class action as the damages exceed $5 million due to the breach of more than 100 customers’ data.
Caesars Slow to Alert Authorities & Users
The Scattered Spider attack specifically targeted Caesars Rewards members, affecting as many as 65 million users. Caesars did not immediately inform authorities or its customers.
In a post on LinkedIn, Cybersecurity Strategist Matthew Rosenquist claims the actual attack took place in August 2023, but Caesars did not report it until September. It then sent users a letter (copy below) in October.
“Time is of the essence when highly sensitive Private Information is subject to unauthorized access and/or acquisition,” states the lawsuit. “The disclosed, accessed, and/or acquired Private Information of Plaintiff and Class Members is now likely available on the Dark Web.”
Second Breach Earlier This Year
The lawsuit claims that Caesars did not adequately protect data following the 2023 attack, and a second breach occurred earlier this year. This breach has been less publicized, but the lawsuit references an article from March that cites social media rumors of another attack.
A post on X claimed that Caesars employees lost access to Okta, an internal system that manages login information.
The lawsuit alleges that the data stolen includes, “at a minimum, Plaintiff’s and Class Members’ contact information and dates of birth. But based on the elements of Private Information that were taken in the 2023 breach, it can be expected that even more sensitive information, including Social Security numbers and driver’s license numbers were also stolen in 2026.”
The complaint alleges that the repeated breaches violate the Federal Trade Commission’s (FTC) guidelines. The FTC did not sanction Caesars over the 2023 breach.
The company was forced to pay a $7.8 million fine over anti-money laundering failures last year. The casino group allegedly allowed illegal bookmakers to launder funds at its properties.
A former employee also brought a lawsuit against the company earlier this month, alleging his dismissal was the result of racial discrimination.
