Teen arrested for conducting large cyber attack on Las Vegas strip resulting in $100M losses for casinos

Authorities announced the arrest of a teenager in connection with a significant cyber attack on Las Vegas casinos that resulted in a financial loss of more than $100 million. The Las Vegas Metropolitan Police Department revealed that the teen faces charges related to extortion and computer-related crimes stemming from a sophisticated cybercrime operation that took place between August and October of 2023. During this period, multiple casinos in Las Vegas were targeted by an organized cyber threat group that went by various names such as “Scattered Spider,” “Octo Tempest,” “UNC3944,” and “0ktapus.”

In response to these attacks, MGM Resorts International reported a financial loss of $100 million to its properties in Las Vegas and regionally, attributing it to a cybersecurity incident that occurred in September of that year. The company promptly shut down certain systems, leading to disruptions but preventing the criminal actors from gaining access to customer bank account numbers or payment card information. Another major entertainment and hospitality company, Caesars Entertainment, experienced suspicious activity within its information technology network due to a social engineering attack on an outsourced IT support vendor. Although the incident did not impact the physical properties and online gaming applications, an unauthorized individual managed to acquire a copy of the loyalty program database containing personal data, including driver’s license and social security numbers of a substantial number of members.

The FBI’s Las Vegas Cyber Task Force, collaborating with local authorities, identified an unnamed teenage boy as a suspect in their investigation. The boy voluntarily surrendered himself to the Clark County Juvenile Detention Center, facing multiple charges related to obtaining and using personal identifying information, extortion, conspiracy to commit extortion, and unlawful acts involving computers. Prosecutors are requesting to transfer the case to the criminal division, treating the teen as an adult to address the charges brought against him.

Both MGM Resorts International and Caesars Entertainment are cooperating with law enforcement agencies and regulatory authorities to investigate the cyber attacks further and enhance their security measures. The actions taken by these companies to address the breaches and protect customer information highlight the persistent threat posed by sophisticated cybercriminals in the digital age. Authorities continue to urge businesses to remain vigilant and implement robust cybersecurity protocols to safeguard against potential cyber threats and mitigate financial and reputational risks associated with data breaches and cyber attacks.