MGM Resorts Expects Cyberattack To Hit Its Revenue

Article by : Erik Gibbs Sep 15, 2023

• 
• 

MGM Resorts confronted a significant cyber disruption that has cast a lingering shadow over its US properties for the past three days. This is now a predicament the company acknowledges as a material risk.

Simultaneously, credit rating giant Moody’s sounded the alarm, cautioning that this cyberattack could adversely affect MGM’s credit rating. Moody’s also pointed to underlying vulnerabilities within the organization.

The aftermath of this cyber assault has been crippling, with corporate email systems, restaurant reservations and hotel bookings all offline. Reports of digital room keys failing were also part of the outcome.

MGM promptly filed an 8-K report with the Securities and Exchange Commission in response. The company confirmed that it was adhering to the protocol followed by publicly traded firms when confronted with events of material consequence.

MGM unequivocally deems this incident material, though they refrained from addressing Moody’s warning.

Financially, MGM’s shares bore the brunt, nosediving over 6% since Monday, when the outages were first acknowledged. This drop contrasts with the reduced gains reported in the broader S&P 500 context over the same timeframe.

The FBI is closely monitoring this ongoing situation. Yet the SEC’s forthcoming cyber disclosure regulations will be in force at year-end, temporarily sparing MGM from further disclosure obligations.

Meanwhile, disgruntled patrons have taken to social media, expressing their vexation over the scale and duration of the outage. Disconcerting accounts of failing user functionalities have emerged, sparking renewed concerns about personal data security.

This incident sheds a harsh light on MGM’s operational vulnerabilities, compelling the company to communicate via non-corporate, commercially available email addresses with the press.

Beyond a brief update on Tuesday confirming the restoration of gaming floors, MGM has offered scant further information. However, according to recent reports, a known hacker group, Scattered Spider, orchestrated the attack. It has since claimed responsibility for the breach.

The group is also allegedly responsible for a similar attack on Caesars Entertainment. Insider sources familiar with the incident revealed this information to Bloomberg, who reported it on Wednesday.

The attack was initiated in late August when the hackers breached one of Caesars Entertainment’s external IT vendors. According to a subsequent report by The Wall Street Journal, Caesars decided to pay approximately 50% of the hackers’ demanded $30 million to safeguard against the release of the stolen data.

Scattered Spider, however, denied any involvement.