MGM resorts says 'cybersecurity issue' may have widespread impact

MGM Resorts International reported a "cybersecurity issue" Monday that may have affected its hospitality, gaming and entertainment properties across the U.S.

The issue may still be affecting the publicly traded company: Some of its websites were down late Monday, and it urged customers to book rooms and request reservations by phone.

Its full impact on reservation systems and casino floors in Las Vegas, the company's base, as well as at properties in Maryland, Massachusetts, Michigan, Mississippi, New Jersey, New York and Ohio, was unknown, spokesperson Brian Ahern said.

• Add to Google

MGM Resorts systems in several states hit by cyberattack

00:26

In a statement Monday evening, the company said that the issue was ongoing but that its casino gaming floors were operational. "We continue to work diligently to resolve this issue," it said.

Earlier in the day, MGM resorts said that the matter affected "some of the company's systems" and that law enforcement had been notified.

Some MGM systems were shut down to protect data, and the company launched an internal investigation with the help of "leading external cybersecurity experts," it said.

The FBI in Las Vegas and the Nevada Gaming Control Board did not respond to requests for comment.

For Subscribers

FOR SUBSCRIBERSAbdul El-Sayed tries to woo MAHA voters as Democrats seek inroads with RFK’s supporters

FOR SUBSCRIBERSGOP super PAC increases its spending for Sen. Jon Husted in tough Ohio race

FOR SUBSCRIBERSKratom-like substances are popping up in a typically benign supplement

FOR SUBSCRIBERSRecords reveal tumultuous marriage between killed New York Times executive and wife

FOR SUBSCRIBERSFrom clean energy warrior to ‘wall of shame,’ James Talarico reverses on a fossil fuel money pledge

FOR SUBSCRIBERSCongressional staff planned official trip with luxury stops in Italy and France weeks before election

FOR SUBSCRIBERSA harrowing ordeal aboard an Israel-bound plane

FOR SUBSCRIBERSOpenAI CEO Sam Altman to skip congressional hearing on rogue AI agents

FOR SUBSCRIBERSKey DOJ lawyers departed Trump ‘grand conspiracy’ probe amid pressure to produce, source says

FOR SUBSCRIBERSTrump’s new AI chatbot often links to a site launched under Clinton 26 years ago

FOR SUBSCRIBERSAt MAHA summit, industry CEOs the movement once vilified take the stage

FOR SUBSCRIBERSThis Paralympian has two goals: Win medals and give away $500,000 to her teammates

FOR SUBSCRIBERSCornell rape allegation spotlights stringent New York state laws that have long drawn criticism

FOR SUBSCRIBERSThe debate over AI’s future rages on both coasts

FOR SUBSCRIBERSDecades-old march dispute reignites in Northern Ireland, threatening political crisis

MGM lists 19 properties in the U.S. They include some of the most popular resorts in Las Vegas, including the Bellagio, Mandalay Bay and the Cosmopolitan. It also has properties in China.

Late last year Nevada's gaming board approved stricter cybersecurity measures, including a three-day window to report any online system breaches.

In July, the Securities and Exchange Commission adopted a similar rule for large, publicly traded companies. It requires a significant breach to be reported within four business days, but the requirement won't be in effect until December.

For Subscribers

FOR SUBSCRIBERSAbdul El-Sayed tries to woo MAHA voters as Democrats seek inroads with RFK’s supporters

FOR SUBSCRIBERSGOP super PAC increases its spending for Sen. Jon Husted in tough Ohio race

FOR SUBSCRIBERSKratom-like substances are popping up in a typically benign supplement

FOR SUBSCRIBERSRecords reveal tumultuous marriage between killed New York Times executive and wife

FOR SUBSCRIBERSFrom clean energy warrior to ‘wall of shame,’ James Talarico reverses on a fossil fuel money pledge

FOR SUBSCRIBERSCongressional staff planned official trip with luxury stops in Italy and France weeks before election

FOR SUBSCRIBERSA harrowing ordeal aboard an Israel-bound plane

FOR SUBSCRIBERSOpenAI CEO Sam Altman to skip congressional hearing on rogue AI agents

FOR SUBSCRIBERSKey DOJ lawyers departed Trump ‘grand conspiracy’ probe amid pressure to produce, source says

FOR SUBSCRIBERSTrump’s new AI chatbot often links to a site launched under Clinton 26 years ago

FOR SUBSCRIBERSAt MAHA summit, industry CEOs the movement once vilified take the stage

FOR SUBSCRIBERSThis Paralympian has two goals: Win medals and give away $500,000 to her teammates

FOR SUBSCRIBERSCornell rape allegation spotlights stringent New York state laws that have long drawn criticism

FOR SUBSCRIBERSThe debate over AI’s future rages on both coasts

FOR SUBSCRIBERSDecades-old march dispute reignites in Northern Ireland, threatening political crisis

"Whether a company loses a factory in a fire — or millions of files in a cybersecurity incident — it may be material to investors,” SEC Chair Gary Gensler said in a statement in July.

South Point Hotel and Casino attorney Barry Lieberman said in a letter to the Nevada board that some of its measures, yet to be enacted at the time, were not needed.

"Almost all licensees have cybersecurity insurance," he said in a letter to the executive secretary of the board. "Those insurance companies require the licensees to take steps necessary to prevent cyber attacks."

Josh Heller, the manager of information security engineering at the wireless technology company Digi International, said contemporary cyberattacks can rapidly spread throughout companies through single, official-looking emails that prompt employees to enter their passwords.

"A simple [phishing] email opened on the corporate network could spread like wildfire," he said.

Heller suggested artificial intelligence could give companies a fast, relatively inexpensive way to alert managers of breaches and "isolate the impact."

Follow-up questions for an MGM Resorts spokesperson went unanswered Monday.