Current:Home > NewsCyberattacks strike casino giants Caesars and MGM-LoTradeCoin
Cyberattacks strike casino giants Caesars and MGM
View Date:2024-12-23 21:23:56
LAS VEGAS — Casino company Caesars Entertainment on Thursday joined Las Vegas gambling rival MGM Resorts International in reporting that it was hit by a cyberattack, but added in a report to federal regulators that its casino and online operations were not disrupted.
The Reno-based publicly traded company told the federal Securities and Exchange Commission that it could not guarantee that personal information about tens of millions of customers was secure following a data breach Sept. 7 that may have exposed driver's license and Social Security numbers of loyalty rewards members.
"We have taken steps to ensure that the stolen data is deleted by the unauthorized actor," the company said, "although we cannot guarantee this result."
Brett Callow, threat analyst for the New Zealand-based cybersecurity firm Emsisoft, said it was not clear if a ransom was paid or who was responsible for the intrusion — and for the attack reported Monday by MGM Resorts.
"Unofficially, we saw a group called Scattered Spider claimed responsibility," Callow said. "They appear to be native English speakers under the umbrella of a Russia-based operation called ALPHV or BlackCat."
Scattered Spider also is known as UNC3944, said Charles Carmakal, chief technical officer at cybersecurity firm Mandiant. He called the group "incredibly disruptive and aggressive" in recent targeting of hospitality and entertainment organizations.
"They leverage tradecraft that is challenging for many organizations with mature security programs to defend against," Carmakal said in a statement.
Mandiant said in a blog analysis published Thursday the group uses SMS text phishing and phone calls to help desks to attempt to obtain password resets or multifactor bypass codes.
"This relatively new entrant in the ransomware industry has hit at least 100 organizations, most of them in the U.S. and Canada," Mandiant said.
Caesars is the largest casino owner in the world, with more than 65 million Caesars Rewards members and properties in 18 states and Canada under the Caesars, Harrah's, Horseshoe and Eldorado brands. It also has mobile and online operations and sports betting. Company officials did not respond to emailed questions from The Associated Press.
The company told the SEC that loyalty program customers were being offered credit monitoring and identity theft protection.
There was no evidence the intruder obtained member passwords or bank account and payment card information, the company reported, adding that operations at casinos and online "have not been impacted by this incident and continue without disruption."
The disclosure by Caesars came after MGM Resorts International, the largest casino company in Las Vegas, reported publicly on Monday that a cyberattack that it detected Sunday led it to shut down computer systems at its properties across the U.S. to protect data.
MGM Resorts said reservations and casino floors in Las Vegas and other states were affected. Customers shared stories on social media about not being able to make credit card transactions, obtain money from cash machines or enter hotel rooms. Some video slot machines were dark.
MGM Resorts has has about 40 million loyalty rewards members and tens of thousands of hotel rooms in Las Vegas at properties including the MGM Grand, Bellagio, Aria and Mandalay Bay. It also operates properties in China and Macau.
A company report on Tuesday to the SEC pointed to its Monday news release. The FBI said an investigation was ongoing but offered no additional information.
Some MGM Resorts computer systems were still down Thursday, including hotel reservations and payroll. But company spokesman Brian Ahern said its 75,000 employees in the U.S. and abroad were expected to be paid on time.
Callow, speaking by telephone from British Columbia, Canada, called most media accounts of the incidents speculative because information appeared to be coming from the same entities that claim to have carried out the attacks. He said recovery from cyberattacks can take months.
Callow pointed to reports that he called "plausible" that Caesars Entertainment was asked to pay $30 million for a promise to secure its data and may have paid $15 million. He also noted that the company did not describe in the SEC report the steps taken to ensure that the stolen data was secure.
The highest ransom believed to have been paid to cyber-attackers was $40 million by insurance giant CNA Financial, Callow said, following a data breach in March 2021.
"In these cases, organizations basically pay to get a 'pinky promise,'" he said. "There is no way to actually know that (hackers) do delete (stolen data) or that it won't be used elsewhere."
veryGood! (336)
Related
- Panel advises Illinois commemorate its role in helping slaves escape the South
- A teen was caught going 132 mph on a Florida interstate. The deputy then called his father to come get him.
- How Kobe Bryant's Wife Vanessa Is Honoring Him During Taylor Swift's Eras Tour
- Taylor Swift gave $100,000 bonuses to about 50 truck drivers who worked on Eras Tour
- School workers accused of giving special needs student with digestive issue hot Takis, other abuse
- Don't overbuy: Here are items you don't need for your college dorm room
- Ciara Teams up With Gap and LoveShackFancy on a Limited-Edition Collection for Every Generation
- Arizona reexamining deals to lease land to Saudi-owned farms
- Tony Hinchcliffe refuses to apologize after calling Puerto Rico 'garbage' at Trump rally
- James Barnes, Florida man who dropped appeals, executed for 1988 hammer killing of nurse
Ranking
- Review: 'Emilia Pérez' is the most wildly original film you'll see in 2024
- No live lion, no problem: Detroit sells out season tickets at Ford Field for first time
- U.K. leader Rishi Sunak's house turned black by Greenpeace activists protesting oil drilling frenzy
- Céline Dion's Sister Shares Update on Singer's Health Amid Battle With Stiff Person Syndrome
- The Daily Money: All about 'Doge.'
- Idaho stabbing suspect says he was out driving alone the night of students' killings
- Authorities identify another victim in Gilgo Beach serial killing investigation
- Nate Diaz, Jake Paul hold vulgar press conference before fight
Recommendation
-
South Carolina to take a break from executions for the holidays
-
When temps rise, so do medical risks. Should doctors and nurses talk more about heat?
-
Americans love shrimp. But U.S. shrimpers are barely making ends meet
-
Remains found in shallow grave in 2007 identified as Florida woman who was never reported missing
-
Over 1.4 million Honda, Acura vehicles subject of US probe over potential engine failure
-
5-year-old girl dies after being struck by starting gate at harness race
-
Veteran Massachusetts police sergeant charged with assaulting 72-year-old neighbor
-
Spoilers! How that 'Mutant Mayhem' post-credits scene and cameo set up next 'TMNT' sequel