28 Sep Major Cyberattack Costs MGM Resorts Over $52 Million in Missed Revenue: Lessons in Cybersecurity and Vigilance

According to a gaming industry analyst’s letter to investors on Sunday, MGM Resorts International may be losing between $4.2 million and $8.4 million in daily revenue and about $1 million in cash flow every day it is the target of a cyberattack.

In a weekly report on gaming, lodging, and leisure businesses, David Katz, an equity analyst with the New York-based Jefferies Group, updated his Thursday assessments of MGM and Caesars Entertainment Inc. He included an estimate that MGM could suffer a 10 to 20 percent hit to revenue and cash flow “for the days that the current conditions exist.”

Following a cybersecurity attack, MGM started its second week of operations on Sunday. MGM earns around $42 million in revenue and $8 million in cash company-wide daily flow., according to analysts at Jefferies.

Cash flow is the amount of net cash and cash equivalents coming into and going out of a firm, whereas revenue represents the amount of money made via sales and investments.

MGM representatives stated on Sunday that there had been no changes to the company’s computer system status and that nothing new had been added to the “frequently asked questions” section of the company’s website, which had just been established early on Friday.

However, there was no shortage of individuals complaining about the circumstance

Others criticized the restored websites for lacking important features. Customers can still book directly with a property via phone or through third-party booking applications.

A server at Babette’s Steakhouse at Park MGM told a Review-Journal reporter that the restaurant’s computer system was constantly slowing down because checks couldn’t be closed out. Additionally, since expenditure tabs cannot be opened again, all meals must be ordered at once. Additionally, there is no splitting of cheques or payment methods within a party.

Because certain ticket in-ticket out systems weren’t working, staff had to manually pay out slot machine wins on the machines that were really in use.

According to Katz, the declaration by CZR (Caesars Entertainment, which disclosed a related cyberattack in a Thursday SEC filing) and indications from MGM confirming the cyberattacks “should be taken as one-time, largely insurable events that should not have long-lasting impacts on the businesses, assuming that the event is short-lived.” “Our sense is that MGM’s impact could potentially be material but moderate near term, while CZR should see no meaningful impact and the question of whether any businesses are displaced among operators near term is fair.”

According to Katz, there have been unsubstantiated accusations that Caesars paid extortionists $15 million in ransom in late August to restore control of its digital systems. However, it’s unclear if MGM has thought about offering any ransom.

According to Katz’s conversations with both management teams, “our impression is that the Street’s presumption that CZR elected to pay a ransom while MGM did not may not be correct.” “However, given that we anticipate that most of the incidents will be insurable for everyone involved, this should lessen the impact on MGM if it turns out to be considerable.

It is yet unclear how much of an impact MGM will experience, how much insurance it will have, or how long the incident will go.

Katz stated that he thinks MGM will keep running.

Our assessment of the effect on MGM is that operations continue as usual, credit card usage is still feasible, albeit manually, and more transactions are cash-based than usual, he said.

A hack has cost MGM Resorts (NYSE:MGM) International, an American hospitality and entertainment company, more than $52 million in missed revenue. The last week’s cyberattack rendered almost all of MGM’s hotels, casinos, and ATMs inoperative.

The attack started with a straightforward social engineering trick. A cybercriminal used details from a LinkedIn post to assume the identity of an MGM employee. The crook then got in touch with the business’ IT division and asked for a password reset. The IT division cooperated without realizing the impersonation, allowing the attacker access to the employee’s account. This finally resulted in the cybercriminal taking over the whole system at MGM.

This event was highlighted by Kingston Police as a clear illustration of the possible risks associated with such schemes. They gave locals tips on how to defend themselves against such assaults. They underlined the need for caution when disclosing personal information online since it may be exploited in phishing attempts by internet crooks.

They also suggested doing identification checks on people before disclosing important information to them. A face-to-face meeting or using another method of interaction might be used to accomplish this. Finally, they urged people not to believe emails, messages, or social media posts that contained frightening details about such occurrences since they can contain false information intended to mislead people.
This event highlights the value of strong cybersecurity measures and alertness to possible social engineering assaults in the current digital environment.

Contact us!