MGM Resorts announced on September 20 that its hotels and casinos were "operating normally" again, roughly 10 days after it reported a "cybersecurity issue" affecting some of its systems1. The company, which owns more than two dozen hotel and casino locations worldwide as well as an online sports betting arm, had shut systems down to protect its data1.
The disruption began on September 11, when MGM reported the issue1. In the days that followed, reports said everything from hotel room digital keys to slot machines were not working, and websites for several properties went offline for a time1. Guests waited in hours-long lines to check in and receive physical room keys, and some received handwritten receipts for casino winnings as the company moved to manual operations1.
In its September 20 statement, the company said some "intermittent issues" were possible and that MGM Rewards might not be available1. It did not provide additional information on why its systems went down1.
On October 5, the company gave a further update: hackers had accessed personal information of "some customers" from before March 2019, including names, contact information, gender, date of birth, and driver's license, passport and Social Security numbers1. MGM did not reveal how many people were affected and said it was providing free credit monitoring services to them1.
A group known as Scattered Spider is believed to be responsible, reportedly using ransomware made by ALPHV, also called BlackCat1. Reports said the hackers found an employee's information on LinkedIn and impersonated them in a call to MGM's IT help desk to obtain credentials1. ALPHV posted a message on September 14 claiming responsibility for the attack but denying it was carried out by teenagers in the US and Europe or that anyone tried to tamper with slot machines1. The message said data was stolen from MGM, which has refused to engage with the hackers or pay any ransom1.
Caesars Entertainment paid millions of dollars to hackers who breached its systems around the same time as MGM, and continued operating normally1. Caesars admitted to the breach in a filing with the Securities and Exchange Commission on September 14, saying an "outsourced IT support vendor" was the victim of a "social engineering attack" that resulted in sensitive data about members of its customer loyalty program being stolen1.
What it means for players
For anyone gambling at an MGM property during the outage, the practical effects were physical rather than digital: room keys had to be issued by hand, check-in queues ran for hours, and casino payouts were recorded on paper receipts1. MGM Rewards, the loyalty program, may not have been available even after systems returned1. The company has not said which properties or countries were affected, and no country-by-country breakdown has been reported.
The October 5 disclosure concerns data from before March 2019, so customers whose details were held by MGM before that date may be affected1. MGM has not said how many customers are involved1. The company is offering free credit monitoring to those affected1. Whether the incident changed entry rules, identification checks or payment procedures at any MGM property has not been reported.
What happens next
MGM has not said whether it will pay any ransom, and it has refused to engage with the hackers so far1. The company has not announced further updates beyond October 51. No regulatory action, fine or investigation into the MGM breach has been reported. Caesars has not announced further steps beyond its September 14 SEC filing1.
For background on how casino floors and loyalty programs work across the region, see Casinos and Integrated Resorts in Asia: Who Can Enter, What You Can Play and the Rules Inside.