MGM updates gaming commissioners on 2023 cybersecurity breach

MGM Resorts International Chief Technology Officer John Branden Newman told Nevada regulators that federal authorities are still investigating a 2023 cyberattack targeting the company, in which a teenager has been charged in connection with the breach.

Newman, approved Thursday as a corporate officer by the Nevada Gaming Commission, confirmed that the individual, now 17, was 15 at the time of the incident. He faces three counts of obtaining and using another person’s identifying information, one count of extortion, one count of conspiracy to commit extortion, and one count of unlawful acts related to computers. Prosecutors have moved to try him as an adult.

“It was obviously a very difficult time for us responding to that incident and rebuilding the environment,” Newman said. “We have put in numerous controls to reduce the risk of any further occurrence of this, and we keep our eye on all the threat intelligence across the industry, including keeping up with the various threat actors that are still hitting people in our industry. We’re still working with the FBI.”

Outreach to Boyd Gaming

Newman described reaching out to Boyd Gaming Corp. after a cyberattack was disclosed in a Securities and Exchange Commission filing this week.

“It’s obviously unfortunate that a lot of the players in the industry and various industries actually are still getting hit by these same types of attacks,” he told commissioners. “We did reach out and offer our support. I don’t have a lot of detailed information about it. The current chief information security officer was the one who was doing that coordination with Boyd during that time to offer ours.”

Newman oversees 653 technology staff, including 376 employees in Nevada. Before joining MGM as CTO, he served as the company’s chief information security officer during the 2023 attack and previously held IT roles with the US Air Force, the Department of Defense, and in the private sector.

Young offenders in cybercrime

Commission Chairwoman Jennifer Togliatti noted the challenges in responding to cyberattacks carried out by younger suspects.

“In order to keep up with it, you have to go to all the proms and all the high schools and all the land,” Togliatti said. “It’s remarkable the age of the folks that are being charged with the acts alleged here. It’s nuts.”

Newman said young offenders are often recruited by organized actors.

“It’s very unfortunate,” he said. “They use these people to distance themselves from the actual law enforcement because these players are normally the last mile that are the touch points, but they’re not the brains behind the operation. So we’re continuing to work with them, and we’ve read on a few people from our team to help the FBI go further in as far as we can to get closer to the real people behind the scenes.”