Hotel and casino operator Boyd Gaming has disclosed a cyberattack to US regulators, warning that hackers may have stolen personal information belonging to employees and other individuals.
The Las Vegas-headquartered revealed Tuesday that attackers breached its tech systems and “removed certain data,” though it has not confirmed when the attack occurred or who was responsible.
Boyd Gaming confirmed that the compromised information included data related to employees “and a limited number of other individuals.” It has not specified who these additional individuals are or provided details about the types of data stolen.
The meaning of ‘limited’
Many data breach disclosures use the word “limited” when describing the impact on individuals’ information, but organizations are known to play a little fast and loose with its definition.
For the record, the Oxford dictionary defines it as “restricted in size, amount, or extent; few, small, or short.”
One recent example was Aussie telco TPG Telecom saying the impact of a breach at subsidiary iiNet was “limited,” and this referred to around 280,000 customers’ email addresses.
TransUnion also said “limited personal information” was affected “for a very small percentage of US consumers,” in its recent breach disclosure… which affected 4.5 million.
In its Form 8-K filing with the SEC, Boyd Gaming went on to say that it does not expect the costs related to cleanup to have a material impact on its financial condition, primarily due to it holding a “comprehensive cybersecurity insurance policy.”
This will cover costs associated with bringing in external digital forensics and incident response teams, as well as legal action or regulatory fines. JLR, take note.
Boyd Gaming operates 27 sites across more than 10 US cities, with most located in Las Vegas. A further site is due to open in Norfolk, Virginia, in 2027.
It employs around 16,000 people and most recently posted annual revenues of $3.9 billion for 2024. ®