MGM Resorts International could be losing between $4.2 million and $8.4 million in daily revenue and around $1 million in cash flow every day it’s under a cyberattack, a gaming industry analyst said in a Sunday report to investors.
David Katz, an equity analyst with New York-based Jefferies Group, in a weekly report on gaming, lodging and leisure companies, updated his Thursday assessments of MGM and Caesars Entertainment Inc. that included an estimate that MGM could take a 10 percent to 20 percent hit on revenue and cash flow “for the days that the current conditions exist.
Read more of the reporting at Las Vegas Review-Journal.
MGM isn’t the only resort giant suffering financially from the attack by a group called “Scattered Spider” or “UNC3944.” It appears that Caesar’s Entertainment, allegedly hit by the same group, was quickly hit with at least one class-action lawsuit. The Data Breach Times notes, however, that at least one news report claims that a member of Scattered Spider denied responsibility for the Caesar’s attack. At of this morning, AlphV has not commented officially on the Caesar’s incident on their leak site.
Although Caesar’s 8-K form filed with the SEC does not explicitly state they paid ransom, the form’s wording does suggest it was paid, with the Wall Street Journal reporting that Caesar’s paid $15 million, which was half of what the attackers reportedly demanded.
While MGM states it does not yet know the scope of the breach in terms of personal information of customers and guests, Caesar’s has already confirmed that the threat actors had acquired Social Security numbers and driver’s license numbers from a “significant number” of loyalty program customers.
In its September 14 statement about the MGM Resorts attack, AlphV (of whom Scattered Spider is thought to be a subgroup) wrote:
We still continue to have access to some of MGM’s infrastructure. If a deal is not reached, we shall carry out additional attacks. We continue to wait for MGM to grow a pair and reach out as they have clearly demonstrated that they know where to contact us.
AlphV not updated that statement since then although they note each day whether they have communicated with any reporters or media.
