\n Posted on: February 20, 2026, 03:20h.\u00a0\n <\/p>\n
\n Last updated on: February 20, 2026, 03:20h.\n <\/p>\n
![\"Avatar](\"https:\/\/www.casino.org\/news\/wp-content\/uploads\/2023\/03\/cropped-3-3-50x50.png\")
<\/div>\n<\/p><\/div>\n<\/p><\/div>\n- \n
- Hackers demand $1.5 million in Bitcoin after claiming to steal 800,000 internal Wynn Resorts employee records<\/strong><\/li>\n
- The stolen data contains sensitive personal information including Social Security numbers, salaries, and birth dates<\/strong><\/li>\n
- The extortionists used an Oracle vulnerability and vishing tactics to compromise Wynn\u2019s internal systems<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong>
\nA prolific data\u2011theft and extortion gang claims to have stolen 800,000 internal records from Wynn Resorts and wants at least $1.5 million in Bitcoin to prevent a leak, according to The Register<\/a>.<\/em><\/p>\n
![\"Wynn](\"https:\/\/www.casino.org\/news\/wp-content\/uploads\/2025\/11\/Wynn-Las-Vegas-858x644.jpg\")
A cyberhacker gang has claimed to have stolen personal information from thousands of current and former employees of Wynn Resorts. (Image: Shutterstock)<\/figcaption><\/figure>\n The records reportedly include the full names, Social Security numbers, email addresses, phone numbers, job titles, salaries, start dates and birthdays of current and former Wynn employees.<\/p>\n
The hacking crew, known as ShinyHunters, posted Wynn\u2019s name on its leak site last week and is<\/p>\n
Wynn Resorts, which operates major luxury properties in Las Vegas and Macau, has not confirmed the breach and did not respond to inquiries from multiple outlets.<\/p>\n
![\"\"](\"https:\/\/www.casino.org\/news\/wp-content\/uploads\/2026\/02\/hacker-shutterstock-430x389.jpg\")
A stock representation of a cyberhacker. (Image: Shutterstock)<\/figcaption><\/figure>\n ShinyHunters told The Register<\/em> that it gained access to Wynn\u2019s systems in September 2025 by exploiting an Oracle PeopleSoft vulnerability using an employee\u2019s credentials. The group did not specify whether those credentials were stolen through social engineering or purchased from an insider.<\/p>\n
ShinyHunters has increasingly relied on voice phishing, or \u201cvishing,\u201d to impersonate IT staff and trick employees into surrendering login credentials and multi\u2011factor authentication codes. This method mirrors the tactics used by Scattered Spider, the group responsible for the 2023 cyberattacks on MGM Resorts and Caesars Entertainment, which resulted in ransomware deployment, operational disruptions, and the theft of tens of thousands of customer records.<\/p>\n
- The stolen data contains sensitive personal information including Social Security numbers, salaries, and birth dates<\/strong><\/li>\n