Hotel and casino giant MGM Resorts has recently disclosed that it suffered a devastating hack attack, leading to significant financial losses and a data breach. The company estimates that the attack cost $110 million in lost revenue and mitigation expenses. This article delves into the details of the breach, explores the potential methods used by attackers, discusses the possibility of a ransom payment, examines the financial consequences for MGM Resorts, highlights the impact on its operations, and outlines the steps taken to assist affected customers.
Details of the data breach
During the hack, attackers gained access to sensitive customer data, including names, contact information, gender, birthdates, and driver’s license numbers. Moreover, some customers’ Social Security numbers or passport numbers may have been acquired as well, exposing them to potential identity theft.
Lack of Information about the Breach
MGM Resorts has not provided any specific details about how their systems were breached. However, there is anecdotal evidence suggesting that the attackers successfully deceived a help desk employee into granting them access to an employee account. This allowed the attackers to bypass multi-factor authentication controls provided by Okta, an identity management company.
Possibility of Ransom Payment
While MGM Resorts has not confirmed or denied it, speculation suggests that the company may have paid a ransom. Interestingly, rival hotel and casino operator Caesars Entertainment appears to have been targeted by the same group and did pay a ransom.
In a regulatory filing, MGM Resorts informed investors that it expects to record a staggering $100 million loss in earnings for the third quarter due to the attack and its response. The $110 million overall cost includes not only lost revenue but also expenses associated with mitigating the attack and strengthening their cybersecurity defenses.
Cybersecurity Insurance Coverage
MGM Resorts states that it believes its cybersecurity insurance will be sufficient in covering the financial impact of the breach. However, the full scope of the costs and related impacts is yet to be determined. This incident serves as a reminder to companies to adequately invest in robust cybersecurity measures.
Impact on Operations
The attack had a substantial impact on MGM Resorts’ operations, particularly its booking system. Due to disruptions, the company saw a decline in September occupancy, falling to 88% compared to September 2022’s 93%. This highlights the significance and long-lasting consequences of a cybersecurity incident on business operations and customer confidence.
Steps Taken to Aid Affected Customers
MGM Resorts has pledged to directly notify affected customers via email. Additionally, the company will offer these individuals two years of identity theft monitoring through Experian, a credit reporting agency. This proactive approach aims to support those affected and mitigate the potential harm caused by the breach.
The hack attack on MGM Resorts has resulted in substantial financial losses, with an estimated $110 million in revenue and mitigation expenses. The breach exposed sensitive customer data, including personal information and potentially even Social Security or passport numbers. The company has not disclosed how their systems were breached, and speculation suggests a potential ransom payment. The impact on MGM Resorts’ operations, including a decline in occupancy, illustrates the far-reaching consequences of a cybersecurity incident. Efforts to aid affected customers underscore the company’s commitment to rectifying the situation. As MGM Resorts navigates the fallout from this attack, it serves as a stark reminder for businesses to prioritize cybersecurity to protect themselves and their customers from future breaches.