All MGM Customer Personal Data Including Social Security Numbers Breached
MGM has confirmed that all customer data provided to the casino and hospitality company prior to March 2019 has been breached following a massive cyber attack last month that crippled operations for more than a week.
Information obtained includes customer contact information, gender, date of birth and driver’s license numbers. Obtaining of one's license number is often the first step in attempting to commit identity fraud. The company has not said whether credit card information was breached.
It gets worse.
“We also believe a more limited number of Social Security numbers and passport numbers were obtained,” the company said in a statement.
“We have no evidence that the criminal actors have used this data to commit identity theft or account fraud.”
MGM anticipates a $100 million hit and possibly a Moody's downgrade.
Experts believe the cyber attack was a result of Scattered Spider, described by Avertium as a "stealthy and persistent threat actor targeting telecom networks".
Once inside a company's systems, the results are crippling as it avoids specialized malware and instead relies on reliable remote management tools to maintain access.
fvx-underground claimed the ransom gang was able to breach the casino giant through a social engineering attack.
“All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk,” vx-underground posted on X (formally known as Twitter).
“A company valued at $33,900,000,000 was defeated by a 10-minute conversation,” the post said.
Some customers took to Twitter Friday morning claiming MGM sent out an email to those possibly impacted with information on how to obtain identity theft monitoring.
It's not immediately clear what recourse affected customers may have moving forward.
- Aaron Goldstein, Gambling911.com
