Company: CZR
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001590895-25-000068
Chunk: 538

Company: Caesars Entertainment, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 538
---
 against future attacks. We also took steps to require that the specific outsourced IT support vendor involved in the matter implement corrective measures to protect against further attacks that could have posed a threat to our systems. While we took these actions, we cannot assure that the stolen data was deleted by the unauthorized actor or that our network and other systems and those of third parties, such as service providers, will not be compromised, damaged, or disrupted by a third-party breach of our system security or that of a third-party provider or as a result of purposeful or accidental actions of third parties, our employees, or those employees of a third party, power outages, computer viruses, system failures, natural disasters, or other catastrophic events in the future. Our third-party information system service providers face risks relating to cybersecurity similar to ours, and we do not directly control any of such parties’ information security operations. As an example, the Data Incident arose from a social engineering attack on one of our outsourced IT vendors resulting in our customer information and other data being accessed by an unauthorized actor. Advances in computer and software capabilities, 

Table of Contents22

encryption technology, new tools, and other developments may increase the risk of a future security breach. Any future security breach, may also result in customer information or other proprietary data being accessed or transmitted by or to a third party. Despite the measures we have implemented to safeguard our information, including actions taken following the Data Incident, there can be no assurance that we are adequately protecting our information.

As a result of the Data Incident, we have become subject to multiple lawsuits and inquiries from state regulators and we may become subject to additional lawsuits, claims and inquiries related to the Data Incident. While the Data Incident did not impact our customer-facing operations, we are unable to predict the full impact of the Data Incident, including any regulatory effects or changes in guest behavior in the future, including whether a change in our guests’ behavior could negatively impact our financial condition and results of operations on an ongoing basis.

We have cybersecurity insurance to respond to a breach which is designed to cover expenses associated with a cybersecurity incident, including costs related to notification, credit monitoring, investigation, crisis management, public relations and legal advice. We also carry other insurance which may cover ancillary aspects of cybersecurity events. While we have submitted claims for insurance coverage relating to the costs incurred as a result of the Data Incident, we are not certain of the extent to which such coverage or third-party indemnification will cover such costs.

Any future data security breaches giving rise to a