Public cyber incident analysis · 2023
MGM Resorts: when a cyber incident reaches the guest experience
Operations, personal data and financial estimates offer different views of this incident. The readiness question: how do you coordinate service delivery as the available information changes?
Analysis of a public incident, not a CyberUP client reference. Disclosures, documents and operational interpretation.
At a glance
An estimate is not the final bill
Estimated impact on Adjusted Property EBITDAR
MGM estimate disclosed on 5 October 2023; not a ransom payment. [1]
Initial one-off expenses
Q3 estimate for technology, advisory services and legal expenses. [1]
Operations and data
Service recovery and the investigation into affected data must be assessed separately.
Figures and dates come from the cited sources. They are not results from a CyberUP exercise.
The documented record
Facts and scope.
What the company disclosed
MGM described shutting down systems to mitigate risk. On 5 October, it reported that operations at its US properties had returned to normal and almost all guest-facing systems had been restored. It also disclosed the theft of some customers’ personal data, including Social Security or passport numbers for a limited number of customers. [1]
What the financial figures cover
The update separated the impact on the operating metric from one-off expenses. The total cost had not yet been determined. In the subsequent quarterly results, the incident sat alongside other economic factors: attributing every change in performance to the attack would conflate different effects. [1] [2]
Key dates
The documented timeline.
Continuity must be judged from the guest’s perspective
The exercise should test more than whether an application is back online. Staff need to know which services they can deliver, what alternatives are available and what limitations remain. A restored system and a guest served without disruption are different outcomes; a programme should observe both.
We propose bringing technical response, property operations, customer service and communications together. For each critical service, the exercise should establish a minimum operating condition and identify who can confirm it. That makes “recovery is under way” a useful status update rather than a blanket assurance.
Financial information also needs clear ownership. In an exercise, Finance may receive incomplete, evolving information: costs already incurred, estimated service impact and possible recoveries. The aim is not to produce a single total immediately, but to preserve the meaning, date and uncertainty of each figure.
This is an operational interpretation, not an assessment of MGM’s internal procedures. We do not have its decision records. Exercise quality is assessed through the decisions and information observable in the participant’s own environment, without attributing undocumented choices to this incident.
From incident analysis to readiness
Three questions to test.
Exercise ideas for your organisation. They do not describe work carried out by CyberUP for the organisation discussed.
Who confirms that the service is usable?
Identify the operational owner who checks the customer journey, alongside the system owner. Record remaining limitations and available alternatives.
What message reaches staff?
Prepare an internal update that distinguishes services that are available, restricted or unavailable. Check who can revise it as the technical picture changes.
How is an estimate updated?
Separate costs incurred, expected impact and assumptions about recovery. Every update should retain its date, scope and the person responsible for the assessment.
Source record
Sources and further reading.
Source dates and the period covered are distinct from this page’s source-review date. CyberUP interpretations are labelled as such. External sources do not imply endorsement or a commercial relationship.
- MGM Resorts International · SEC · 5 October 2023
Form 8-K — incident update (opens in a new tab)Primary company disclosure. Item 7.01: operations, preliminary financial estimates and personal data. - MGM Resorts International · 8 November 2023
Third-quarter 2023 results (opens in a new tab)Primary company results. Separates the effects of the incident from other factors influencing performance.