What happened during the MGM Resorts cyberattack?
MGM Resorts disclosed a large-scale cyberattack on September 11, 2023, which disrupted hotel services including reservations, casino gaming, and digital room keys, as reported by Hotel Dive. The outage also shut down ATMs and slot machines and took the company's website and online booking systems offline, according to TechCrunch. Scattered Spider, an affiliate of the ALPHV/BlackCat ransomware group, claimed responsibility for the attack days after it began. While MGM has not publicly stated how attackers gained access, security researchers attributed the intrusion to social engineering, Hotel Dive reported.How did MGM Resorts disclose the cyberattack?
MGM Resorts moved from its first public notice to a specific financial estimate in 24 days. The table below details the public steps taken by MGM Resorts and their reported sources.| Date | Public Step | Source |
|---|---|---|
| September 11, 2023 | MGM discloses a large-scale cyberattack | TechCrunch |
| September 14, 2023 | A Scattered Spider representative tells TechCrunch the group was behind the attack | TechCrunch |
| October 5, 2023 | MGM files an 8-K estimating about $100 million of impact and confirming customer data was taken | BleepingComputer |
What was the financial cost of the attack to MGM Resorts?
MGM Resorts estimated a negative financial impact of approximately $100 million to its Adjusted Property EBITDAR, which is a property-level earnings measure. The company also reported less than $10 million in one-time expenses, as stated in its October 5, 2023 Form 8-K and reported by BleepingComputer. September occupancy at MGM Resorts properties fell to 88% from 93% a year earlier. This decline occurred because guests could not book through the company's website or mobile application, according to Hotel Dive's summary of the filing. MGM also confirmed that hackers stole personal information from an unspecified number of customers, TechCrunch reported. An analyst research note, cited by Hotel Dive, indicated that MGM held a policy covering about $200 million in business interruption and ransomware costs. The same note characterized the financial hit as a small portion of the roughly $4.7 billion in EBITDAR the company was projected to generate that year.How did MGM Resorts address the ransom question publicly?
MGM Resorts declined to state whether it paid a ransom, and public information on this issue came from press reports. GovInfoSecurity reported that MGM declined to answer questions regarding a payment. The Wall Street Journal, citing an unnamed source, reported that the company had not paid any ransom. Caesars Entertainment, which experienced a similar cyberattack, chose a different approach. The table below compares the reported ransom positions of both companies.| Company | Reported Ransom Position | How the Public Learned It |
|---|---|---|
| MGM Resorts | Reportedly refused to pay | Wall Street Journal report citing an unnamed source; MGM declined to comment |
| Caesars Entertainment | Reportedly paid about half of a $30 million demand | Caesars told investors it paid |
