MGM Resorts Hit with $100 Million Data Breach
Cyberattack on MGM Resorts Exposes Thousands of Customers’ Personal Information
September 2023 – MGM Resorts has confirmed that hackers stole an unspecified amount of customers’ personal information during a September cyberattack that will cost the hotel and casino giant an estimated $100 million.
The hotel and casino giant first disclosed it had been targeted by a large-scale cyberattack on September 11, which caused widespread disruption across MGM’s properties, shutting down ATMs and slot machines and pulling the company’s website and online booking systems offline.
Timeline of Events:
- September 11: A large-scale cyberattack hits MGM Resorts, causing disruptions to its operations.
- September 14: The Scattered Spider hacking group claims responsibility for the attack on the dark web leak site.
- October 2023: MGM Resorts files a regulatory report admitting that hackers obtained some personal information belonging to customers who transacted with the company prior to March 2019.
Data Breach Details:
The data breach exposed a range of sensitive customer information, including:
- Names
- Contact Information
- Gender
- Dates of Birth
- Driver License Number
- Social Security Numbers (for a limited number of customers)
- Passport Details (for a limited number of customers)
The company has not yet disclosed how many individuals have been affected by the data breach, but MGM’s resorts attract tens of millions of visitors each year.
Financial Impact:
MGM Resorts expects the attack to reduce its third-quarter profit by approximately $100 million. The company has also spent around $10 million in one-time expenses related to the cyberattack, mostly on technology consulting services, legal fees, and expenses of other third-party advisors.
Cyber Insurance Policy:
The company believes that its cyber insurance policy will be sufficient to cover the financial impact to its business. However, it noted that "the full scope of the costs and related impacts of this issue has not been determined."
No Evidence of Identity Theft or Account Fraud:
MGM said it has seen no evidence that the data obtained by the criminal actors has been used for identity theft or account fraud.
Current Status:
While MGM claims that the cyberattack has been "fully contained" and that operations at the company’s resorts have "returned to normal," some of the MGM’s services were still not operational at the time of writing, according to customer complaints on social media, including MGM’s mobile app.
