Free tools Windows power users keep installed
One-click scans. No signup required.
Wynn Resorts reported that an unauthorized party accessed certain human-resources systems and obtained records involving 21,775 people. Wynn says the intrusion occurred on October 5, 2025, was discovered on February 20, 2026, and led to consumer notifications on April 3, 2026.
The precise data involved varied by person. ShinyHunters claimed responsibility and reportedly claimed to possess more than 800,000 records, but that figure is not the number of people Wynn or regulators confirmed as affected. A ransom payment has also not been publicly verified.
As an Amazon Associate I earn from qualifying purchases.
What Wynn confirmed
Wynn’s filing with the Maine Attorney General lists 21,775 affected people, including five Maine residents. The rounded “21,000 employees” figure used in headlines should not be read as a precise count, and the official wording does not establish that everyone was a current employee. The affected population included people whose records related to employment with, or services provided to, Wynn or its properties.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsAccording to Wynn’s notification materials, the unauthorized access involved certain human-resources systems. Wynn said it contained the incident, notified federal law enforcement, engaged outside cybersecurity specialists, and reviewed the records involved.
#1 Best Overall
The timeline
- October 5, 2025: Date of the unauthorized access listed in the Maine filing.
- February 20, 2026: Wynn discovered the intrusion.
- April 3, 2026: Consumer notification date listed in the filing.
The incident was discovered months after the listed access date. That gap does not, by itself, establish how the attacker entered the systems or whether the attacker maintained continuous access throughout the period.
What information was exposed?
Wynn’s notice says affected records contained a person’s name and additional personal information. The exact data elements varied by recipient. Therefore, it would be inaccurate to say that every affected person’s Social Security number, financial information, passwords, or other particular identifier was exposed.
Affected people should rely on their individual Wynn notification letter for the specific categories of information associated with their records. The available notice also says Wynn had not found evidence of identity theft or fraud attributable to the incident at the time of notification. That statement describes what Wynn knew then; it is not a guarantee that misuse cannot occur later.
Did ShinyHunters hack Wynn?
ShinyHunters claimed responsibility and reportedly claimed to have obtained more than 800,000 records. That is an assertion by the threat actor, not the confirmed number of people affected in Wynn’s regulatory filing.
Wynn’s public notification describes an unauthorized party rather than conclusively establishing the attacker’s identity. Security reporting has associated the activity with the broader criminal ecosystem often called Scattered Lapsus$ Hunters, but that attribution remains qualified. The available public records do not independently prove that ShinyHunters alone carried out the intrusion.
The difference matters: Wynn confirmed unauthorized access and acquisition of data, while the identity and affiliation of the attacker remain claims or reported assessments.
Rank #3
Was Wynn’s data deleted?
Wynn’s notice says the threat actor stated that all stolen data had been deleted. That is an attacker’s statement, not independent verification that every copy was destroyed. Data could theoretically exist in backups, screenshots, downloaded files, private exchanges, or the hands of other parties.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →SecurityWeek reported that Wynn disappeared from an alleged leak site and that the attackers demanded more than 22 bitcoin, estimated at approximately $1.5 million at the time. Those facts may prompt speculation about negotiations or payment, but they do not prove that Wynn paid a ransom.
There is no verified public confirmation in the available records that Wynn made a ransom payment. Keep these possibilities separate:
- Ransom demand: A reported request for payment.
- Suspected negotiation: An inference based on surrounding events.
- Verified payment: Not publicly confirmed here.
- Deletion: A claim attributed to the threat actor, not proof of destruction.
What Wynn is offering affected people
Wynn is offering affected individuals 24 months of Kroll services, including credit monitoring, fraud consultation, and identity-theft restoration. The offer and enrollment deadline may be specific to each recipient.
Use the instructions, activation code, and deadline in your actual Wynn letter. Do not copy an enrollment code from another person or rely on a deadline published in a generic article. The notice identifies Kroll’s enrollment site as enroll.krollmonitoring.com/redeem; independently verify the address before entering personal information.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Credit monitoring can alert you to some suspicious activity, but it does not prevent someone from attempting identity theft. It is also different from a credit freeze.
Best Value
What affected employees, former employees, and contractors should do
- Confirm the notice. Contact Wynn through a known company channel or use contact details in the letter. Do not provide passwords, one-time codes, or Social Security numbers to unsolicited callers or email senders claiming to represent Wynn or Kroll.
- Enroll in Kroll. Follow the individualized instructions and save the activation confirmation, enrollment code, and service expiration date.
- Consider a credit freeze. A freeze is generally free and restricts prospective creditors from accessing your credit file. Place freezes separately with Equifax, Experian, and TransUnion. Monitoring and a freeze serve different purposes.
- Review financial, payroll, and benefits activity. Watch for unfamiliar accounts, tax filings, direct-deposit changes, benefit elections, password resets, or requests to change payment details. Verify any request through a trusted phone number or portal.
- Secure important accounts. Use unique passwords and multifactor authentication for email, payroll, benefits, banking, and identity-provider accounts. Secure email first because it is often used to reset other passwords.
- Watch for phishing. Treat unexpected “Wynn breach,” Kroll, payroll, or benefits messages as suspicious. Avoid searching for or downloading allegedly leaked files, which may expose you to malware or additional scams.
- Report suspected identity theft. Preserve letters, emails, screenshots, and account records. The Federal Trade Commission’s IdentityTheft.gov provides a recovery plan and reporting guidance.
Former employees and service providers may be affected even if they no longer work for Wynn. If you are unsure whether you are included, use Wynn’s verified contact route rather than responding to an unsolicited message.
What remains unknown
- Whether Wynn paid any ransom.
- Whether every copy of the data was deleted.
- The full technical entry point and attack path.
- The complete set of data fields for every affected person.
- Whether ShinyHunters, a related group, or another actor should receive definitive attribution.
The most reliable facts are Wynn’s confirmed unauthorized access, the official count of 21,775 affected people, the October 2025 access date, the February 2026 discovery date, and the April 2026 notification date. Claims about a larger record haul, attribution, ransom activity, and deletion should remain clearly labeled as claims or reported interpretations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
