The hotel chain MGM Resorts confirmed that an unknown number of people had their data stolen during the recent multiday hack and estimated that the damages would total $100 million.
The chain acknowledged in a new Securities and Exchange Commission filing that the hackers responsible for the September cyberattack, which disrupted facilities and left hotel attendees unable to gamble or access their rooms, also accessed the personal information of customers who had transacted with MGM Resorts since March 2019. The compromised data include names, contact information, customers' gender, dates of birth, and driver's license numbers. A smaller number of customers also had their Social Security and passport information taken.
THE REAL COST OF BIDEN'S $127 BILLION STUDENT LOAN GIVEAWAY
MGM did not disclose how many people were affected. However, the facility does have tens of millions of visitors every year. The hotel chain declined to comment on any questions about the data.
The hotel's damages are also expected to bring the company's profit margins down by $100 million in the third quarter, according to the filing. MGM Resorts expects its cyber insurance policy will be "sufficient" to cover the costs of the damages, but "the full scope of the costs and related impacts of this issue has not been determined."
The company did not pay the attacker's ransom demand, according to the Wall Street Journal. The cyberattack is "fully contained," and operations have "returned to normal," MGM Resorts' team said, although customers say that some of its services remain inoperable.
A representative of the hacker group Scattered Spider told TechCrunch that it was behind the MGM attack. The group is believed to be part of ALPHV, a network of developers who create ransomware to take over computer systems. Scattered Spider has not released any files from MGM, making it hard to confirm its claim.
CLICK HERE TO READ MORE FROM THE WASHINGTON EXAMINER
Scattered Spider is a Western-based hacker group made up primarily of minors, who are recruited because they face less severe penalties under the law if caught, according to Allison Nixon, the chief research officer at the cybersecurity company Unit 221B. It reportedly hit more than 130 organizations in 2022 and stole the credentials of almost 10,000 employees, according to Crowdstrike.
MGM was not the only one affected by a hack. Caesar's Entertainment was affected by a similar attack, and the company paid at least half of a $30 million ransom to stop Scattered Spider from releasing the collected data to the darker parts of the internet.