MGM Resorts cyberattack sparked customer data breach, cost the company $100 million
Regulatory filings and a letter from MGM Resorts CEO William Hornbuckle Wednesday claim a recent cyberattack entailed both a leak of customer data as well as a hefty financial hit to the company.
Hornbuckle attempted to downplay just how severe the data break was, however.
"We have determined that because of our fast, early response, the incident did not result in a compromise of any customer bank account numbers or payment card information," Hornbuckle said in a public letter. "We do understand that the criminal actors obtained certain personal information belonging to some customers who transacted with us prior to March 2019."
Hackers obtained data like customer names, contact information, date of birth, gender and driver's license numbers. A "more limited number" of Social Security numbers and passport numbers were also hacked during the attack, Hornbuckle wrote.
"We have no evidence that the criminal actors have used this data to commit identity theft or account fraud," he added.
Hornbuckle noted the company shut down IT systems to mitigate the risk of any widespread data leak and worked with federal law enforcement and external cybersecurity experts on investigating the attack.
The company did not pay off hackers demanding a ransom like Caesars Entertainment did weeks prior to the MGM cybersecurity issue, the Wall Street Journal reported this week.
While the Federal Bureau of Investigation discourages companies from paying cyber hackers a ransom, Caesars is believed to have paid roughly $15 million in ransom. The company claims its operations weren't impacted, per earlier WSJ reporting.
But Caesars did note in a September regulatory filing that hackers "acquired a copy of, among other data, our loyalty program database, which includes driver's license numbers and/or social security numbers for a significant number of members in the database."
The Caesars filing last month emphasized there was "no evidence to date that any member passwords/PINs, bank account information, or payment card information (PCI) were acquired by the unauthorized actor."
MGM's fallout
Social media reports in recent weeks depicted a state of bedlam at MGM Resorts, ranging from shutdown slot machines to manual credit card processing, following the cyberattack.
The CEO's letter Wednesday claims "the vast majority of our systems have been restored."
But a filing with the U.S. Securities and Exchange Commission indicates the attack likely caused the company to take a $100 million hit. The MGM Resorts filing attributes much of this to guests changing or canceling reservations during the month of September, which had an 88% occupancy rate across the company this year compared to 93% in 2022.
The company expects occupancy rates across its resorts to be 93% in October, slightly down from the 94% seen the same month last year, but then fully recover in November.
The SEC filing reiterated the company believed the "unauthorized third-party activity" is now contained.
What to do if your personal information was stolen at MGM or Caesars
Hornbuckle indicated customers whose data was comprised in the cyberattack will have been notified via email. MGM Resorts is offering free credit monitoring and free identity protection services to those impacted.
The company also established a dedicated call center at 1-800-621-9437 that can be reached Monday through Friday from 9 a.m. until 11 p.m. EST and from 11 a.m. until 8 p.m. on Saturdays and Sundays. Those who dial in should reference number B105892 when calling.
There is also a dedicated website outlining additional information of the cyberattack and steps to take to protect personal information, including remaining alert for unsolicited communications involving personal information and monitoring credit reports for potential fraud.
While Caesars claims its operations were back to normal, the company still indicated it would notify customers "in the coming weeks" impacted by its own data breach.
If you aren't sure if you were impacted, you can reach out to a dedicated response line for Caesars at 1-888-652-1580 from 9:00 a.m. to 9:00 p.m. EST, Monday through Friday other than on holidays.
What about Marriott?
The timing of the MGM Resorts cyberattack arrived weeks ahead of the planned launch month of a new partnership between the casino conglomerate and Marriott International.
The new deal, replacing a prior partnership between MGM and Hyatt, was expected to be a deeper relationship involving a new collection brand as well as tie-ins to the BetMGM online betting and gaming platform.
It is unclear if the cyberattack pushed back the planned October launch of the MGM Collection with Marriott Bonvoy. Representatives with Marriott did not respond to TPG's request for comment in time for publication.
But it certainly appears MGM is ready to at least be back to normal in November in time for the Formula 1 Las Vegas Grand Prix.
"The Company believes it is well-positioned to have a strong fourth quarter, with record results expected in November primarily driven by Formula 1," reads the MGM Resorts SEC filing from Wednesday.
Related reading:
- Best hotel credit cards
- When is the best time to book a hotel? Experts weigh in — and debunk a few myths
- The best credit cards to reach elite status
- A comparison of luxury hotel programs from credit card issuers
- Which credit cards offer the most lucrative rewards for hotel stays?
- The best hotel rewards programs in the world
TPG featured card
at American Express's secure site
Terms & restrictions apply. See rates & fees.
| 3X | Earn 3X Miles on Delta purchases. |
| 1X | Earn 1X Miles on all other eligible purchases. |
Pros
- Delta SkyClub access when flying Delta
- Annual companion ticket for travel on Delta (upon renewal)
- Ability to earn MQDs through spending
- Various statement credits for eligible purchases
Cons
- Steep annual fee of $650
- Other Delta cobranded cards offer superior earning categories
- Earn 100,000 Bonus Miles after you spend $6,000 or more in purchases with your new Card within the first 6 months of Card Membership and an additional 25,000 bonus miles after you make an additional $3,000 in purchases on the Card within your first 6 months, starting from the date that your account is opened. Offer Ends 04/01/2026.
- Delta SkyMiles® Reserve American Express Card Members receive 15 Visits per Medallion® Year to the Delta Sky Club® when flying Delta and can unlock an unlimited number of Visits after spending $75,000 in purchases on your Card in a calendar year. Plus, you’ll receive four One-Time Guest Passes each Medallion Year so you can share the experience with family and friends when traveling Delta together.
- Enjoy complimentary access to The Centurion® Lounge in the U.S. and select international locations (as set forth on the Centurion Lounge Website), Sidecar by The Centurion® Lounge in the U.S. (see the Centurion Lounge Website for more information on Sidecar by The Centurion® Lounge availability), and Escape Lounges when flying on a Delta flight booked with the Delta SkyMiles® Reserve American Express Card. § To access Sidecar by The Centurion® Lounge, Card Members must arrive within 90 minutes of their departing flight (including layovers). To access The Centurion® Lounge, Card Members must arrive within 3 hours of their departing flight. Effective July 8, 2026, during a layover, Card Members must arrive within 5 hours of the connecting flight.
- Receive $2,500 Medallion® Qualification Dollars with MQD Headstart each Medallion Qualification Year and earn $1 MQD for each $10 in purchases on your Delta SkyMiles® Reserve American Express Card with MQD Boost to get closer to Status next Medallion Year.
- Enjoy a Companion Certificate on a Delta First, Delta Comfort, or Delta Main round-trip flight to select destinations each year after renewal of your Card. The Companion Certificate requires payment of government-imposed taxes and fees of between $22 and $250 (for itineraries with up to four flight segments). Baggage charges and other restrictions apply. Delta Basic experiences are not eligible for this benefit.
- $240 Resy Credit: When you use your Delta SkyMiles® Reserve American Express Card for eligible purchases with U.S. Resy restaurants, you can earn up to $20 each month in statement credits. Enrollment required.
- $120 Rideshare Credit: Earn up to $10 back in statement credits each month after you use your Delta SkyMiles® Reserve American Express Card to pay for U.S. rideshare purchases with select providers. Enrollment required.
- Delta SkyMiles® Reserve American Express Card Members get 15% off when using miles to book Award Travel on Delta flights through delta.com and the Fly Delta app. Discount not applicable to partner-operated flights or to taxes and fees.
- With your Delta SkyMiles® Reserve American Express Card, receive upgrade priority over others with the same Medallion tier, product and fare experience purchased, and Million Miler milestone when you fly with Delta.
- Earn 3X Miles on Delta purchases and earn 1X Miles on all other eligible purchases.
- No Foreign Transaction Fees. Enjoy international travel without additional fees on purchases made abroad.
- $650 Annual Fee.
- Apply with confidence. Know if you're approved for a Card with no impact to your credit score. If you're approved and you choose to accept this Card, your credit score may be impacted.
- Terms Apply.
- See Rates & Fees