Casino giant MGM expects $100 million hit from hack that led to data breach

MGM Resorts International announced on Thursday that it expects a $100 million impact on its third-quarter results due to a cyberattack that occurred last month. The attack prompted the company to shut down its systems temporarily to mitigate the damage. Additionally, MGM anticipates incurring less than $10 million in one-time costs related to the incident for the quarter ending on September 30.

Following the cyberattack, customers shared images on social media showing error messages on slot machines and long queues at Las Vegas hotels owned by MGM. The company has not disclosed whether it paid any ransom or was asked to do so.

MGM confirmed that the private data of customers who used its services before March 2019 was compromised. This includes contact information, gender, date of birth, and driver's license numbers. It also stated that a limited number of Social Security numbers and passport numbers may have been obtained. However, there is no evidence to suggest that the stolen data has been used for identity theft or account fraud.

Data breaches often involve hackers demanding ransom or selling stolen data to other cybercriminals. The FBI is currently investigating the MGM data breach, which serves as a reminder of the vulnerability of large organizations to cybercrime.

MGM clarified that no customer bank account numbers or payment card information were accessed, and the breach did not affect data from its luxury resort hotel, The Cosmopolitan of Las Vegas.

The full extent of the costs and impacts resulting from the breach is yet to be determined, according to MGM's regulatory filing. However, the company expects a negative impact of approximately $100 million on its adjusted property core profit for its Las Vegas Strip division. It also projects a 93% occupancy rate for October, compared to 94% in the same month last year.

MGM stated that most of its guest-facing systems have been restored, and it does not anticipate any impact on its full-year results due to the breach. The company remains optimistic about a strong fourth quarter, with record results expected in November, primarily driven by a Formula One racing event scheduled to take place in Las Vegas.