The Caesars Entertainment Ransomware Attack: Why Paying Isn't a Strategy
In September 2023 — the same month MGM was devastated by Scattered Spider — Caesars Entertainment was hit by the same group using the same social engineering technique. Caesars paid approximately $15 million in ransom and restored operations quickly. Their story is not a success — it's a precedent that proves paying ransomware demands creates more risk, not less.
Caesars paid ~$15M ransom. It didn't prevent their data from being published.
What Happened at Caesars
Scattered Spider used a social engineering attack against an IT support contractor to gain initial access to Caesars' network. They exfiltrated significant data including the loyalty programme database before deploying ransomware. Caesars negotiated and paid approximately $15 million — reportedly half the original $30M demand. Operations were restored within days. However, the payment does not appear to have prevented some of the exfiltrated data from being circulated subsequently.
Why Paying Ransomware Doesn't Protect You
- Data that was exfiltrated before payment may still be published, sold, or used for identity fraud
- Payment confirms to attackers that you are a viable target — increasing future attack probability
- Ransomware groups share target lists — payment marks you as a payer
- GDPR and regulatory obligations still apply regardless of whether ransom was paid
- Law enforcement agencies explicitly advise against payment
Frequently Asked Questions
Are there legal consequences for paying ransomware demands?
In some jurisdictions, paying ransomware demands may constitute payments to sanctioned entities (if the ransomware group is on a sanctions list), which can itself be illegal. Always consult legal counsel before paying.
Stop ransomware before it demands payment
Kyanite Blue specialises in cybersecurity for iGaming operators. MGA-licensed operators across Malta trust our stack.
Get in touchReady to secure your iGaming operation?
MGA-licensed operators across Malta trust Kyanite Blue.