The Day the Slots Stopped: Insights from MGM Resorts' Cybersecurity Breaches
Ah, the digital age! Where life is convenient, and hotels run on computer systems, not just star ratings. But with great power, comes…you guessed it, great responsibility (thanks, Spiderman). A responsibility to protect sensitive data, especially when cyber incidents are now lurking at every corner. Just ask MGM Resorts.
The most recent headline? MGM Resorts had to shut down its IT systems after a cyber attack. Yes, the same company that experienced a data breach in 2019 - one first disclosed at about 10.6 million guest records, with later reporting putting the exposed dataset at more than 140 million. Déjà vu? Almost feels like a bad action movie sequel, doesn't it? So, let's dissect what went wrong and how businesses, big or small, can brace themselves better against cyber threats.
The MGM Resorts Cyber Incident: A Quick Recap
MGM Resorts International recently disclosed that they are dealing with a cybersecurity issue affecting some of its systems. This includes their main website, online reservations, in-casino services like ATMs, slot machines, and yes, even credit card machines.
Now, imagine you're an MGM Rewards customer, all excited about a weekend getaway, only to find that the app is down and you've been redirected to call a Member Services number. Not the best way to kick off a vacation, right?
Oh, and did I mention? Some guests even reported their room keys weren't working. Well, that's one way to start a lock-picking hobby.
Why Should SMBs, Business Leadership, and Boards of Directors Care?
Now, I know what some of you might be thinking. "Hey, that's MGM. We're just a small or medium-sized business. Why should we be concerned?"
Well, if cyber criminals can breach the security of a mammoth like MGM (twice!), imagine what they can do to smaller businesses with possibly lesser cybersecurity measures in place. Data breaches aren't just about stolen data. It's about trust, brand image, and even financial repercussions.
Moody's flagged the incident as credit negative for MGM within days of the attack, and the financial press tracked the lingering disruptions for more than a week. Is any business ever truly prepared to face the cascading effects of a cyber incident?
The Bigger Picture: Public Companies and Cybersecurity Risk
This isn't just about MGM Resorts. Public companies are continually facing cybersecurity risks. The hackers? They're only getting smarter and more audacious. Remember when cyberattacks were just about bragging rights? Nowadays, it's a business model. And trust me, business is booming.
MGM's recent cyberattack was claimed by the AlphV BlackCat ransomware group. If ransomware groups were to be listed on stock exchanges, they might just be some of the most rapidly growing companies out there.
Now, here's a chilling thought: the next time you swipe your card at a store or enter personal information on a website, could your data be the next jackpot for cybercriminals?
Practical Steps Moving Forward
Okay, let's shake off the doomsday vibe and focus on the silver lining. Yes, cyber threats are real, and yes, they're evolving. But that doesn't mean businesses should throw in the towel just yet.
Invest in Cybersecurity Infrastructure: This is non-negotiable. Regular system checks, secure firewalls, and multi-factor authentication systems are a start.
Educate Staff: A company's cybersecurity is only as strong as its weakest link. Ensure that employees understand the risks and can spot red flags.
Have a Response Plan: Plan for the worst. If a data breach occurs, have an action plan to address the issue promptly and transparently.
Stay Updated: Cybersecurity isn't a 'set it and forget it' type of deal. With new threats emerging regularly, staying updated is crucial.
All things considered…
I'll end with a rhetorical question (because what's an editorial without one?). Are businesses doing enough to protect themselves from the looming shadow of cyber incidents? In the world of cyber threats, staying proactive, rather than reactive, might just be the secret sauce to survival.
Stay safe, stay secure, and remember, while technology can be our best friend, complacency is the real enemy.
What this means for a business your size
The MGM attack started with a phone call, not a zero-day. Attackers impersonated an employee to the IT help desk and talked their way into access. For a smaller business, the question is simple: if someone called your IT support today claiming to be you and asked for a password reset, what would happen? Write down the answer. Then set verification requirements for every reset and access change, decide in advance what you would shut down during an incident and who has the authority to decide it, and test whether your business could run for a week without its systems. MGM could absorb a nine-figure hit and keep operating. Most businesses can't.
Sources
- MGM Resorts statement on the September 2023 incident (SEC Form 8-K exhibit)
- Moody's (credit-negative designation, September 2023)
- MGM data breach settlement (official settlement administrator)
Disclaimer. This article is provided for general information only. It is not legal, regulatory, or professional advice, and reading it does not create a client relationship with WOM Technology Management Group. Regulations, threats, and vendor products change; specific obligations depend on your industry, jurisdiction, contracts, and data. Verify anything you plan to rely on against the primary source and consult qualified counsel or a security professional before acting.
Sources are cited as of the last-reviewed date shown above. Where a linked source has moved or been withdrawn, the citation reflects what was verifiable at review time.