MGM, one of the leading resort giants, is reeling from the aftermath of a damaging cyberattack that occurred in September. The assailants successfully accessed a vast amount of personally identifiable information (PII) from MGM’s clientele, an incident that the company anticipates will lead to a staggering $100 million loss.
In a recent filing with the Securities and Exchange Commission (SEC), MGM detailed the uncertainty surrounding the comprehensive costs of this breach. The silver lining, if any, for the company is its belief that its cyber insurance policy might absorb the majority of the financial fallout.
The compromised data includes customer names, contact details such as phone numbers, emails, postal addresses, genders, birth dates, and driver’s license numbers. More alarmingly, a subset of customers also had their Social Security and passport numbers fall into the wrong hands. The variation in the types of information accessed differs from one individual to another. On a positive note, MGM has assured its customers that critical data like passwords, bank account numbers, and payment card details remained untouched. Additionally, there hasn’t been any identified incident of identity theft or fraudulent activities stemming from this breach.
MGM has been proactive in its response. Collaborating with top-tier cybersecurity experts, the company is working diligently to fortify its digital defenses, signaling its commitment to preventing future breaches. Interestingly, MGM has remained silent on the topic of ransom demands. Yet, sources like The Wall Street Journal suggest that MGM stood its ground, refusing to cave to the hackers’ demands. This is in contrast to Caesars Entertainment, another victim of a similar attack, which is rumored to have parted with a significant sum to stop the exposure of their stolen data.
A Legal Nightmare: The Ripple Effect of the Attack
In the aftermath of the cyber intrusion, MGM finds itself embroiled in six class action lawsuits filed in Nevada District Court. These suits argue that MGM and Caesars Entertainment neglected to secure the personal identifiable information of their loyalty program members. The allegations are grave, suggesting that both entities’ oversights led to sensitive customer data being hijacked by malicious ransomware culprits.
Highlighting the global nature of cyber threats, Eastern European hacker groups, namely ALPHV and Scattered Spider, have declared their involvement in these attacks.
Why This Should Alarm Business Leaders Everywhere
This incident isn’t just a cautionary tale for MGM and similar entities; it’s a stark warning for businesses across the board. Here’s why:
Financial Implications: MGM’s projected loss of $100 million demonstrates that the financial repercussions of a cyberattack can be debilitating. It’s not just about immediate losses; a company’s brand value and future revenue can also take a significant hit.
Legal Challenges: The six class action lawsuits against MGM underscore the growing trend of businesses being held legally accountable for data breaches. This adds an extra layer of potential financial and reputational damage.
Trust and Loyalty at Stake: A company’s relationship with its customers is built on trust. Once that trust is broken, as seen with MGM’s breach, regaining it is a Herculean task.
Global Threat Landscape: The involvement of international hacker groups signifies that cyber threats are borderless. Businesses must be prepared for attacks from any corner of the world.
In conclusion, MGM’s predicament serves as a potent reminder of the dire consequences that arise from not adequately securing one’s digital assets. In an era where data is king, businesses must invest robustly in cybersecurity measures to safeguard their customers, reputation, and bottom line.
Rory A. Cooksey is the Director of Growth for WheelHouse IT
