Editorial draft v1 · Evidence reader R2 · Evidence cutoff: October 5, 2023
Disclosures covered: September 12 statement, furnished with the September 13 filing; October 5 follow-up. This is a retrospective account of those disclosures.
MGM Resorts' September 2023 cybersecurity incident disrupted operations and involved the theft of some customers' personal information, according to the company's selected disclosures. Its account developed from an initial announcement of system shutdowns and an open investigation into an October assessment of restoration, customer-data impact, and preliminary financial effects. The later filing made the consequences more specific without establishing a final incident cost. September statement · October update
Shutdowns and restoration
On September 12, MGM said it had recently identified a cybersecurity issue affecting certain systems. It had begun an investigation with external cybersecurity specialists, notified law enforcement, and shut down certain systems to protect its operations and data. The statement appeared as Exhibit 99.1 to a September 13 filing: the statement date and filing date are different. Neither establishes the exact intrusion or discovery day. Initial filing · September statement
By October 5, MGM said operations at its domestic properties had returned to normal and virtually all guest-facing systems had been restored. Some guest-facing systems still needed restoration, which the company expected in the coming days. MGM believed the unauthorized activity was contained and said further work to strengthen safeguards was ongoing. This was a dated assessment of substantial recovery, with work still remaining. October update
What MGM reported about customer information
The October filing said criminal actors had obtained personal information belonging to some customers who had transacted with MGM before March 2019. The information included names, contact details, gender, dates of birth, and driver's license numbers. For a limited number of customers, Social Security numbers and passport numbers were also obtained. MGM said the information involved varied by individual; the selected disclosures do not give a total affected-person count. October update
MGM did not believe that customer passwords, bank-account numbers, or payment-card information had been obtained, or that the actors had accessed The Cosmopolitan of Las Vegas systems or data. It reported no evidence at that point of identity theft or account fraud using the stolen information. The company planned legally required notifications and offers of identity protection and credit monitoring. These findings and beliefs retain their October 5 scope; they do not establish what happened after that date. October update
Financial effects with different measures and periods
MGM estimated a negative third-quarter 2023 impact of approximately $100 million to Adjusted Property EBITDAR, covering its Las Vegas Strip Resorts and Regional Operations collectively. Adjusted Property EBITDAR is the company's defined segment earnings measure. The figure is a preliminary earnings-impact estimate, rather than a disclosed ransom payment or a complete accounting of incident costs. October update
Separately, MGM reported less than $10 million in one-time third-quarter expenses for technology consulting, legal fees, and other third-party advisers. Management believed cybersecurity insurance would be sufficient to cover the operational disruption, those one-time expenses, and future expenses. That expectation did not establish that recoveries had been recognized or received. MGM said the full scope of costs and related impacts remained undetermined. October update
The company expected the operational impact to fall predominantly in the third quarter, particularly in Las Vegas, with a minimal fourth-quarter impact. It did not expect a material effect on its financial condition and results for the full year. Those forecasts address different periods from the quarterly EBITDAR estimate. MGM also cautioned that quarter-end reporting was incomplete and final results could differ materially from its preliminary account. October update
What the disclosure sequence establishes
The September statement established a response under way; the October filing added specific data findings, restoration progress, and financial categories. Editorial interpretation: the useful distinction is between the initial investigation and the later, still-qualified assessment—not a claim that the incident had reached a fully verified final resolution. The selected sources do not establish a named attacker, an initial-access technique, a total affected population, or final costs and insurance recoveries. September statement · October update
Sources
Initial filing — September 13, 2023.
Company statement — September 12, 2023; furnished September 13.
Follow-up filing — October 5, 2023.