Last month’s hack at MGM Resorts International is projected to cost the company $100 million in lost funds.
MGM made the estimate in a Thursday stock exchange filing that outlined the company’s response to a cyber attack that shut down and disrupted casino and hotel access across its properties.
The filing says the cyber attack’s toll was particularly bad in Las Vegas, where MGM runs several hotels including Aria Resort, Bellagio, and Mandalay Bay. In addition, the company had to pay “less than $10 million in one-time expenses” to help it contain and fend off the hack.
The good news for MGM is that it bought cybersecurity insurance, which it says “will be sufficient to cover the financial impact to its business as a result of the operational disruption.” That said, the full financial toll from the attack still remains unclear.
But in some bad news, MGM has confirmed the hackers stole some information from consumers during the attack, specifically customers who did business with the company prior to 2019 . How many people were ensnared remains unknown, but the hackers stole information including names, phone numbers, email addresses, dates of birth, driver’s licenses and in some cases social security and passport numbers.
“We will offer free identity protection and credit monitoring services to individuals who receive an email from us indicating that their information was impacted,” said MGM Resorts’ CEO Bill Hornbuckle in a separate statement.
Hornbuckle added that MGM’s “early response” to the incident prevented the hackers from accessing customers' bank account and payment card information. Nevertheless, the attack may stir up debate over whether MGM should have simply paid off the hackers.
Last month, the company that runs Caesar’s Palace in Las Vegas also revealed it had been breached. But according to The Wall Street Journal, the company decided to pay half of a $30 million ransom to help it contain the threat.
In the meantime, MGM Resorts’ CEO says “the vast majority” of the company’s systems have been restored, which is nearly a month after the cyber attack initially took place. A notorious hacking group known as ALPHV or BlackCat has claimed responsibility for the incident. In their own post, the hacking group has said MGM refused to communicate with them.
“We still continue to have access to some of MGM's infrastructure,” the group claimed back on Sept. 14th. “If a deal is not reached, we shall carry out additional attacks.”