Wynn Resorts Experiences Employee Data Breach: Extortion Threat Confirmed

Following confirmation from Wynn Resorts that a hacker had breached their systems and stolen employee data, the company took immediate action to investigate the incident with the help of cybersecurity experts.

The unauthorized access resulted in the acquisition of certain employee data by a third party, as disclosed in a statement provided to BleepingComputer.

The company immediately implemented its incident response protocols upon discovery of the breach and conducted a thorough investigation to address the security incident.

Although Wynn Resorts did not disclose whether a ransom was paid to prevent data leakage, the attackers claimed that the stolen data had been deleted. It is common for threat actors to make such claims after negotiating with victims.

Wynn Resorts assured that there has been no evidence of the stolen data being published or misused, emphasizing that guest operations and physical properties remain unaffected. The company also offered complimentary credit monitoring and identity protection services to affected employees.

ShinyHunters Leak Site Listing

Wynn Resorts’ presence on the ShinyHunters data leak site raised concerns after the group threatened to publish stolen PII and employee data if the company did not engage by a specified deadline.

Over 800k records containing sensitive information were compromised, according to the now-deleted post on the ShinyHunters data leak site.

Shortly after the data leak site listing, the entry related to Wynn Resorts was removed, a common occurrence during negotiation phases or when claims are disputed.

Wynn Resorts refrained from commenting on ransom payments or the extent of the data breach’s impact. Similarly, ShinyHunters declined to provide details on potential payments received.

The threat actors previously asserted that they obtained the data from Wynn Resorts’ Oracle PeopleSoft environment, indicating a targeted attack on the company’s systems.

ShinyHunters, known for extorting organizations by threatening to release stolen data, has a history of breaching high-profile entities and operating across underground forums to carry out data theft incidents.

Notably, ShinyHunters has claimed responsibility for various security breaches, including those affecting prominent organizations such as Panera Bread, Betterment, SoundCloud, Canada Goose, PornHub, and Match Group.

Recent tactics employed by ShinyHunters include voice phishing attacks targeting single sign-on (SSO) accounts at major tech companies, demonstrating the group’s evolving strategies to obtain sensitive information.

As reported by BleepingComputer, ShinyHunters have adopted new techniques like device code vishing to compromise Microsoft Entra authentication tokens and gain unauthorized access to SaaS applications.

Discover how automation can streamline IT workflows and enhance reliability with Tines’ comprehensive guide. Learn to build intelligent workflows on existing tools for improved efficiency.

Get the guide