Security

MGM Resorts confirms hackers stole customers’ personal data during cyberattack

Comment

An Arcimoto FUV on the Las Vegas strip
Image Credits: Arcimoto

MGM Resorts has confirmed hackers stole an unspecified amount of customers’ personal information during a September cyberattack that will cost the hotel and casino giant an estimated $100 million.

The hotel and casino giant first disclosed it had been targeted by a large-scale cyberattack on September 11. The cyberattack, which was days later claimed by hackers from ALPHV subgroup Scattered Spider, caused widespread disruption across MGM’s properties, shutting down ATMs and slot machines and pulling the company’s website and online booking systems offline.

In a regulatory filing on Thursday, the company admitted that the hackers responsible for the attack obtained some personal information belonging to customers who transacted with MGM Resorts prior to March 2019. This includes names, contact information, gender, dates of birth and driver license number. For a limited number of customers, hackers also accessed Social Security numbers and passport details, the company said.

It’s not yet known how many individuals have been affected by the data breach, but MGM’s resorts attract tens of millions of visitors each year. MGM spokespeople Andrew Chapman and Brian Ahern have repeatedly declined to answer TechCrunch’s questions about the incident.

In its filing, MGM added that it does not believe that customer passwords or payment details were obtained during the attack.

MGM’s filing with regulators reveals that the company expects the attack to reduce its third-quarter profit by approximately $100 million. MGM said it has also spent around $10 million in one-time expenses related to the cyberattack, mostly on technology consulting services, legal fees and expenses of other third-party advisors.

According to The Wall Street Journal, MGM Resorts reportedly did not pay the attackers’ ransom demand, the amount of which is not yet known. When asked by TechCrunch, a representative for the Scattered Spider group did not comment. MGM’s rival Caesars Entertainment, which was also hit by a recent ransomware attack, is said to have paid about half of the $30 million demanded by the hackers to prevent the disclosure of stolen data. Media reports said the Scattered Spider group was also responsible for the Caesars cyberattack, but the group told TechCrunch at the time it had “no involvement” with the incident.

MGM said it expects that its cyber insurance policy will be “sufficient” to cover the financial impact to its business, but noted that “the full scope of the costs and related impacts of this issue has not been determined.”

The company added that it has seen “no evidence” that the data obtained by the criminal actors has been used for identity theft or account fraud.

The listing for MGM Resorts found on the dark web leak site of the ALPHV ransomware gang has not been updated since September 14, and it doesn’t appear that the hackers have yet published any of the data stolen from the hotel giant.

While MGM claims that the cyberattack has been “fully contained” and that operations at the company’s resorts have “returned to normal,” some of the MGM’s services were still not operational at the time of writing, according to customer complaints on social media, including MGM’s mobile app.

“The company continues to focus on restoring the remaining impacted guest-facing systems and the Company anticipates that these systems will be restored in the coming days,” MGM said. 

Motel One says ransomware gang stole customer credit card data

More TechCrunch

Less than one year after its iOS launch, French startup ten ten has gone viral with a walkie talkie app that allows teens to send voice messages to their close…

French startup ten ten finds viral success and controversy in reinventing walkie-talkies

Featured Article

Unicorn-rich VC Wesley Chan owes his success to a Craigslist job washing lab beakers

While all of Wesley Chan’s success has been well-documented over the years, his personal journey…not so much. Chan spoke to TechCrunch about the ways his life impacts how he invests in startups.

9 hours ago
Unicorn-rich VC Wesley Chan owes his success to a Craigslist job washing lab beakers

Presumptive Republican presidential nominee Donald Trump now has an account on the short-form video app that he once tried to ban. Trump’s TikTok account, which launched on Saturday night, features…

Trump takes off on TikTok

With fewer than 400,000 inhabitants, Iceland receives more than its fair share of tourists — and of venture capital.

Iceland’s startup scene is all about making the most of the country’s resources

Kobo put out a handful of new e-readers a few weeks back: color versions of the excellent Libra 2 and Clara, as well as an updated monochrome version of the…

Kobo’s new e-readers are a sidegrade most can skip (with one exception)

In an interview at his home near Reykjavík, the entrepreneur-turned-VC shared thoughts on his ventures and the journey that led him from Unity to climate tech, a homecoming of sorts.

Unity co-founder David Helgason’s next act: Gaming the climate crisis

Welcome back to TechCrunch’s Week in Review — TechCrunch’s newsletter recapping the week’s biggest news. Want it in your inbox every Saturday? Sign up here. Over the past eight years,…

Fisker collapsed under the weight of its founder’s promises

What is AI? We’ve put together this non-technical guide to give anyone a fighting chance to understand how and why today’s AI works.

WTF is AI?

President Joe Biden has vetoed H.J.Res. 109, a congressional resolution that would have overturned the Securities and Exchange Commission’s current approach to banks and crypto. Specifically, the resolution targeted the…

President Biden vetoes crypto custody bill

Featured Article

Industries may be ready for humanoid robots, but are the robots ready for them?

How large a role humanoids will play in that ecosystem is, perhaps, the biggest question on everyone’s mind at the moment.

1 day ago
Industries may be ready for humanoid robots, but are the robots ready for them?

VCs are clamoring to invest in hot AI companies, and willing to pay exorbitant share prices for coveted spots on their cap tables. Even so, most aren’t able to get…

VCs are selling shares of hot AI companies like Anthropic and xAI to small investors in a wild SPV market

The fashion industry has a huge problem: Despite many returned items being unworn or undamaged, a lot, if not the majority, end up in the trash. An estimated 9.5 billion…

Deal Dive: How (Re)vive grew 10x last year by helping retailers recycle and sell returned items

Tumblr officially shut down “Tips,” an opt-in feature where creators could receive one-time payments from their followers.  As of today, the tipping icon has automatically disappeared from all posts and…

You can no longer use Tumblr’s tipping feature 

Generative AI improvements are increasingly being made through data curation and collection — not architectural — improvements. Big Tech has an advantage.

AI training data has a price tag that only Big Tech can afford

Keeping up with an industry as fast-moving as AI is a tall order. So until an AI can do it for you, here’s a handy roundup of recent stories in the world…

This Week in AI: Can we (and could we ever) trust OpenAI?

Jasper Health, a cancer care platform startup, laid off a substantial part of its workforce, TechCrunch has learned.

General Catalyst-backed Jasper Health lays off staff

Featured Article

Live Nation confirms Ticketmaster was hacked, says personal information stolen in data breach

Live Nation says its Ticketmaster subsidiary was hacked. A hacker claims to be selling 560 million customer records.

2 days ago
Live Nation confirms Ticketmaster was hacked, says personal information stolen in data breach

Featured Article

Inside EV startup Fisker’s collapse: how the company crumbled under its founders’ whims

An autonomous pod. A solid-state battery-powered sports car. An electric pickup truck. A convertible grand tourer EV with up to 600 miles of range. A “fully connected mobility device” for young urban innovators to be built by Foxconn and priced under $30,000. The next Popemobile. Over the past eight years, famed vehicle designer Henrik Fisker…

2 days ago
Inside EV startup Fisker’s collapse: how the company crumbled under its founders’ whims

Late Friday afternoon, a time window companies usually reserve for unflattering disclosures, AI startup Hugging Face said that its security team earlier this week detected “unauthorized access” to Spaces, Hugging…

Hugging Face says it detected ‘unauthorized access’ to its AI model hosting platform

Featured Article

Hacked, leaked, exposed: Why you should never use stalkerware apps

Using stalkerware is creepy, unethical, potentially illegal, and puts your data and that of your loved ones in danger.

2 days ago
Hacked, leaked, exposed: Why you should never use stalkerware apps

The design brief was simple: each grind and dry cycle had to be completed before breakfast. Here’s how Mill made it happen.

Mill’s redesigned food waste bin really is faster and quieter than before

Google is embarrassed about its AI Overviews, too. After a deluge of dunks and memes over the past week, which cracked on the poor quality and outright misinformation that arose…

Google admits its AI Overviews need work, but we’re all helping it beta test

Welcome to Startups Weekly — Haje‘s weekly recap of everything you can’t miss from the world of startups. Sign up here to get it in your inbox every Friday. In…

Startups Weekly: Musk raises $6B for AI and the fintech dominoes are falling

The product, which ZeroMark calls a “fire control system,” has two components: a small computer that has sensors, like lidar and electro-optical, and a motorized buttstock.

a16z-backed ZeroMark wants to give soldiers guns that don’t miss against drones

The RAW Dating App aims to shake up the dating scheme by shedding the fake, TikTok-ified, heavily filtered photos and replacing them with a more genuine, unvarnished experience. The app…

Pitch Deck Teardown: RAW Dating App’s $3M angel deck

Yes, we’re calling it “ThreadsDeck” now. At least that’s the tag many are using to describe the new user interface for Instagram’s X competitor, Threads, which resembles the column-based format…

‘ThreadsDeck’ arrived just in time for the Trump verdict

Japanese crypto exchange DMM Bitcoin confirmed on Friday that it had been the victim of a hack resulting in the theft of 4,502.9 bitcoin, or about $305 million.  According to…

Hackers steal $305M from DMM Bitcoin crypto exchange

This is not a drill! Today marks the final day to secure your early-bird tickets for TechCrunch Disrupt 2024 at a significantly reduced rate. At midnight tonight, May 31, ticket…

Disrupt 2024 early-bird prices end at midnight

Instagram is testing a way for creators to experiment with reels without committing to having them displayed on their profiles, giving the social network a possible edge over TikTok and…

Instagram tests ‘trial reels’ that don’t display to a creator’s followers

U.S. federal regulators have requested more information from Zoox, Amazon’s self-driving unit, as part of an investigation into rear-end crash risks posed by unexpected braking. The National Highway Traffic Safety…

Feds tell Zoox to send more info about autonomous vehicles suddenly braking