Company: CZR
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001590895-25-000068
Chunk: 859

Company: Caesars Entertainment, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 859
---
 risk profile of new third-party service providers and maintains communication channels with key third-party service providers to evaluate and respond to possible effects of incidents within a service provider’s organization. We rely on, and in certain cases require, our third parties to communicate such incidents timely.As previously disclosed, on September 14, 2023, we announced that an unauthorized actor had gained access to our information technology network as a result of a social engineering attack on an outsourced IT support vendor used by the Company, and acquired a copy of, among other data, our loyalty program database, which includes driver’s license numbers and/or social security numbers for a significant number of members in the database (“Data Incident”). After detecting suspicious activity in our information technology network, we activated our IRP, which included containment measures, and commenced an investigation of the incident. We also notified law enforcement and state gaming regulators, engaged legal counsel and other third-party incident response and cybersecurity professionals, as well as forensic professionals.We have received, and continue to pursue, reimbursements from insurance carriers for costs incurred as a result of the Data Incident. Based on our assessment, the incident has not had a material impact, and we do not believe the incident has materially affected or will materially affect us, including our operations, business strategy, results of operations, or financial condition. As a result of the Data Incident, numerous putative class action lawsuits have been filed against us purporting to represent various classes of persons whose personal information was affected by the Data Incident. These class actions assert a variety of common law and statutory claims based on allegations that we failed to use reasonable security procedures and practices to safeguard customers’ personal information, and seek monetary and statutory damages, injunctive relief and other related relief. In addition to those putative class action lawsuits, individual claims have been filed or threatened against us as well.We have also received inquiries from numerous state regulators related to the Data Incident. We are responding to these inquiries and cooperating fully with regulators. See Note 8 for further discussion.We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

Governance 

Our Board considers cybersecurity risk as critical to the enterprise and is responsible for reviewing our cybersecurity risk profile, including management’s design, implementation and enforcement of our cybersecurity risk management program. The Board of Directors receive periodic updates and presentations on cybersecurity topics from our CISO, supported by internal security staff and/or external experts, as part of the Board