MGM Resorts resumes full operations 10 days after cyber attack

All MGM Resorts hotels and casinos have resumed normal operations, about ten days after a cyberattack disrupted the company's systems. "We are pleased that all of our hotels and casinos are operating normally," the Las Vegas-based company announced on X (formerly known as Twitter).

The cyber attack, initially detected on September 10, caused significant disruption across MGM's casinos in the United States, impacting the company's websites, reservation system, and certain slot machines. The FBI is currently investigating the incident.

Details regarding the extent of the MGM breach, including the nature of compromised information and the financial impact on the company, have not been disclosed.

Please read our latest update below. Learn more: https://t.co/INKgreBSrt pic.twitter.com/N4zbQEFJFr

— MGM Resorts (@MGMResortsIntl) September 20, 2023

Gregory Moody, the director of the cybersecurity program at the University of Nevada, Las Vegas, cited estimated losses of up to $8 million per day during the computer shutdown, potentially totaling $80 million, the Associated Press (AP) reported. However, Moody highlighted MGM Resorts' annual revenues exceeding $14 billion, indicating an average weekly revenue of at least $270 million.

On Wednesday, the company reported that systems handling resort services, dining, entertainment, pools, and spas are fully operational. Its website and app are now accepting dining and spa reservations, while efforts are underway to restore hotel booking and loyalty reward functions, the report said.

"MGM Resorts properties in Las Vegas and throughout the country are back to normal operations," spokesman Brian Ahern was quoted as saying to AP.

The MGM attack was reportedly carried out by the same group of attackers that breached Caesars Entertainment just weeks earlier. Identified as Scattered Spider, the group has also reportedly breached the security of three additional companies in the manufacturing, retail, and technology sectors.

Caesars Entertainment officially confirmed that it suffered a data breach that may have resulted in the exposure of sensitive information, including data from its loyalty program database. The Wall Street Journal reported that the company paid approximately half of a $30 million ransom demanded by the hackers. 

As per experts, the incidents revealed significant cybersecurity vulnerabilities at MGM and Caesars Entertainment, dispelling the notion of casino invincibility.

“At this point, all casinos should be moving to the highest defensive posture possible and taking active measures to verify the integrity of their systems and environment, and reviewing — if not activating — their incident response processes,” said Christopher Budd, a director of threat research at cybersecurity firm Sophos X-Ops, as reported by AP. “There’s been attacks against multiple casinos, and it’s possible we’ll see more.”

Caesars Entertainment, the world's largest casino owner with more than 65 million rewards members, operates properties in 18 states and Canada under various brands, including Caesars, Harrah's, Horseshoe, and Eldorado. It also has mobile and online operations, including sports betting.

MGM Resorts, Nevada's largest private employer, operates numerous hotel rooms in Las Vegas, including flagship locations like MGM Grand, Bellagio, Aria, New York-New York, and Mandalay Bay. The company also runs resorts in China and Macau and employs 75,000 people across the United States and internationally.