The OYO Las Vegas hotel-casino suffered a cyberattack between January 8–11, 2025, exposing personal and financial data of ~4,700 guests, employees, and business partners. The LockBit 3.0 ransomware group leaked 30GB of sensitive data—including internal reports, casino operations documents, and financial records—on the dark web after an eight-month delay in official reporting (reported to Maine AG only on September 18, 2025). The breach occurred under Highgate Hotels Inc.’s management, leading to legal disputes over negligence, contract violations, and termination notices. OYO accused Highgate of ‘deficient’ IT security, while Highgate countered with labor law violations in a separate lawsuit. The incident aligns with a broader trend of ransomware attacks on Las Vegas casinos, following similar breaches at MGM Resorts, Caesars Entertainment, and Boyd Gaming in prior years. The leaked data’s scope suggests severe reputational, financial, and operational risks, compounded by regulatory scrutiny and ongoing litigation.

The OYO Las Vegas hotel-casino suffered a cyberattack between January 8–11, 2024, exposing sensitive data of approximately 4,700 guests, employees, and business partners. The breach, linked to the LockBit 3.0 ransomware group, resulted in 30 GB of leaked data on the dark web, including personal and financial records, internal financial statements, and casino operations documents. The incident was disclosed eight months later (September 2024) via Maine’s attorney general and court filings tied to a legal dispute between OYO Hotels and Highgate Hotels Inc.. The breach was cited as evidence of negligent IT practices, leading to OYO’s termination of Highgate’s management contract. The attack disrupted trust, risked financial fraud, and exposed regulatory non-compliance, with potential long-term reputational and operational damage to the casino-hotel.