how it happened
- whoattackerssocial engineering
- the gapoutsourced supportvendor access into the network
- thenloyalty database65M+ members
- the resultransom ~$15Mpaid
what everyone assumed
An outsourced support vendor feels like a utility: necessary, trusted, and somebody else’s payroll. The assumption is that their access is bounded to support tasks and that they sit outside the threat model, more service provider than risk.
what happened
The attacker socially engineered the outsourced support vendor, used that foothold to reach the company’s network, and exfiltrated the loyalty database. The vendor’s legitimate access became the attacker’s path, with no direct assault on the company required.
step by step
- the outsourced support vendor is socially engineeredThe attacker gains a foothold through the vendor's legitimate access.the assumption breaks here
- the vendor's access leads into the networkNo direct assault on Caesars is needed.
- the loyalty database is exfiltrated65 million plus members, many with licence and Social Security numbers.
- September 2023breach disclosed, ransom paidA payment near $15 million, negotiated down from $30 million.
how it surfaced
In September 2023 Caesars disclosed a breach of its loyalty program, 65-plus million members including driver’s-license and Social Security numbers for many. A ransom near $15 million was paid, negotiated down from $30 million.
An outsourced vendor’s access is your access, and their attack surface is yours.
Whoever can reach your systems is part of your perimeter, regardless of whose name is on their paychecks.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAn attacker phones the support company pretending to be one of your employees.what it costs youWith the support company's access, they reach your customer database without touching you directly.
- or it goes like thisit happenedMGM Resorts, 2023howA caller poses as an admin and gets a password and code reset in minutes.what leavesadmin control of identity and cloudwho ends up with itattackers who deploy ransomware
- or it goes like thisit happenedClorox and Cognizant, 2023howAn outsourced desk resets an account three times without checking the caller.what leavesa fully working employee loginwho ends up with itan intruder who looks legitimate everywhere
sources
- The Register, 2023
- Caesars SEC 8-K
your turn
what you can do about it
this week
List each outside party that can reach your systems, and how they prove who they are.
A support vendor, an MSP, or a contractor can reach your systems right now, and their security is something you mostly take on trust. That trusted reach is exactly what Caesars' attacker borrowed. Knowing what each external party can touch, and how they prove who they are, is the work this incident points to.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →