MGM Resorts and Caesars hit by Scattered Spider
MGM Resorts International; Caesars Entertainment
Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.
Why this severity: Ransomware and extortion; social engineering of IT help desk / outsourced IT support
- Started
- Sep 7, 2023
- Closed
- Oct 5, 2023
Affected
Not published yet
Fixed in
No fixed release yet
Updates by day5
▸Oct 5, 2023
Link #MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen
Source
▸Sep 14, 2023
Link #Caesars 8-K filing; reports say it paid about half of a $30M demand
Source
▸Sep 12, 2023
Link #MGM statement on the cybersecurity issue
Source
▸Sep 11, 2023
Link #MGM Resorts discloses a cybersecurity issue and shuts down systems; reservations, slot machines and ATMs are disrupted
Source
▸Sep 7, 2023
Link #Caesars determines the attacker copied its loyalty program database, including driver's license and/or SSNs for many members
Source
Advisories2
News & write-ups4
- MGM Resorts statement on cybersecurity issueMGM Resorts · Sep 12, 2023
- Caesars paid millions in ransom to cybercrime group prior to MGM hackCNBC · Sep 14, 2023
- Hackers say they stole 6 terabytes of data from casino giants MGM, CaesarsReuters · Sep 14, 2023
- MGM Resorts ransomware attack led to $100 million loss, data theftBleepingComputer
Notes & caveats
The ~$15M Caesars payment is from press reports (CNBC/WSJ), not from the 8-K.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
