Crystal Bay Casino crystalbaycasino.com Crystal Bay Casino data breach: what happened and what to do
Crystal Bay Casino found unusual network activity in November 2022. Files may have been copied around November 27, 2022. Notices went out from February 24, 2023, and the Maine Attorney General lists 86,291 people affected. Your letter lists what was exposed for you.
View all 13,177 breaches- Breach date
- 27 Nov 2022
- Made public
- 24 Feb 2023
- Affected
- 86,291
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Crystal Bay Casino, a casino on Lake Tahoe in Nevada, noticed unusual activity on parts of its network in November 2022. Its investigation found that certain files may have been copied from its systems on or around November 27, 2022. On January 25, 2023, it found that some database information may have been copied too.
The casino reported the incident to the FBI and began mailing notice letters on February 24, 2023. The Maine Attorney General's breach listing records 86,291 people affected in total and gives the cause as an external system breach.
Sources checked: oag.ca.gov, maine.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
The casino's notice names the affected data in a per-person field that follows "your name", so the exact list differs by letter. Your own letter is the authority on what was involved for you.
Names plus the other details a casino keeps on file are enough for targeted phishing, and some data types, such as a driver's license number, can feed identity theft. If your letter lists one of those, treat it more seriously.
The casino's response
Crystal Bay Casino says it took steps to secure its systems, reported the incident to the FBI and is reviewing its security policies. It offered affected people free credit monitoring through IDX, with an enrollment deadline of May 24, 2023, which has passed. Its letter gave an assistance line at 1-833-753-4563.
If you got a letter
Match what you do to the data type in your letter. The steps below follow FTC guidance for breaches.
What to do if you were in it
- 1
Read your letter for the data types
Each notice lists the information involved for that person. Everything else you do depends on it.
- 2
Expect phishing that mentions the casino
If your email address or phone number was involved, be wary of messages that quote the breach. Go to the casino's website directly instead of using links in a message.
- 3
Freeze your credit if an ID number was involved
If your letter lists a driver's license number or Social Security number, the FTC says you can place a free credit freeze at Equifax, Experian and TransUnion.
- 4
Check your credit reports and statements
Get your free reports at annualcreditreport.com and review card and bank statements for charges you don't recognize.
- 5
Report identity theft at IdentityTheft.gov
If someone uses your information, the FTC's IdentityTheft.gov gives you a recovery plan and a way to report it.
Official filings
- Washington Attorney General , filed 24 Feb 2023 : 1,480 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Crystal Bay Casino breach?
If the casino sent you a notice letter, your information was in the files it reviewed. The casino began mailing letters on February 24, 2023.
How many people were affected?
The Maine Attorney General's listing shows 86,291 people in total.
What was exposed?
Each notice lists the data types for that person, starting with their name. The casino has not published one list that covers everyone.
Can I still get the free credit monitoring?
The enrollment deadline in the notice was May 24, 2023. Call the casino's assistance line at 1-833-753-4563 to ask whether it's still open.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
