Teen arrested over massive cyber attack on Las Vegas strip that cost casinos $100M

A teenage boy has been arrested over a massive cyber attack on the Las Vegas strip that cost casinos at least $100 million, according to authorities and official reports.

The Las Vegas Metropolitan Police Department announced Friday the teen has been accused of multiple charges, including extortion and unlawful acts regarding computers, for a “sophisticated cyber crime” from 2023.

From August to October 2023, several Las Vegas casinos were targeted by an “organized cyber threat-actor group,” police said. This group went by multiple names, including “Scattered Spider, “Octo Tempest,” “UNC3944,” and “0ktapus,” according to authorities.

In October 2023, MGM Resorts International filed a report with the U.S. Securities and Exchange Commission, in which it said it had lost $100 million from its Las Vegas strip resorts and regional operations due to a “cyber security issue” that past September.

MGM said it “responded swiftly and shut down” certain U.S. company systems after the issue was detected. This caused “disruptions” at some of its properties, “but allowed the Company to prevent the criminal actors from accessing any customer bank account numbers or payment card information.”

Caesars Entertainment reported “suspicious activity in its information technology network resulting from a social engineering attack on an outsourced IT support vendor used by the Company” in a September 2023 report to the Securities and Exchange Commission.

The company said its physical properties and its online and mobile gaming applications were not impacted by the incident. But, an “unauthorized actor” obtained a copy of its loyalty program database, which included driver’s license and social security numbers for a “significant number” of members.

“We have taken steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result,” Caesars told the commission.

The Independent has reached out to MGM and Caesars for comment.

The FBI’s Las Vegas Cyber Task Force, which included local police. identified an unnamed teenage boy as a suspect in its investigation, and he surrendered himself to the Clark County Juvenile Detention Center on September 17, police say.

The boy was charged with three counts of obtaining and using personal identifying information of another person to harm or impersonate person, one count of extortion, one count of conspiracy to commit extortion and one count of unlawful acts regarding computers.

Local prospectors are seeking to move the teen to the criminal division, where he would face the charges as an adult, police say.