MGM Resorts International chief executive officer Bill Hornbuckle made the decision not to pay a ransom to hackers who breached the company’s computer system because they did not request money until after the attack was discovered. In an interview on Tuesday, Hornbuckle revealed that the hackers had already infiltrated MGM’s systems for several days before sending a ransom note. Due to the advanced stage of the attack and the fact that the company had already begun rebuilding offline systems, Hornbuckle chose not to respond to the hackers’ demands.
Hornbuckle stated, “I’d love to tell you there was this, you know, ‘a jump on a white horse moment and devil be damned – we’re not paying these bastards’. The reality is because we caught this so early and we were on them.”
MGM, the largest owner of casinos on the Las Vegas Strip, estimated that the hack began on the evening of September 7. Despite attempting to shut down systems before the attackers could steal any data, the hackers managed to access the company’s corporate Domain Name System (DNS) layer, which is responsible for running all of a company’s applications and can be used to deploy malware. “They had gotten into the arteries to the heart so they could choke things off,” explained Hornbuckle.
Management responded to the attack by creating a war room comprised of executives, IT professionals, lawyers, and cybersecurity consultants. Employees working with guests resorted to manual operations, recording customer information and credit card details on clipboards during check-in. Slot machine players were paid in cash by attendants instead of receiving paper vouchers.
The hackers only sent a ransom note several days later, by which point they had already disrupted critical systems such as payroll, purchasing, phones, and a reservation booking system handling 20,000 reservations per day. “Literally everything was out,” said Hornbuckle. “They clearly got wind of what we were doing and closed us down in the balance.”
Cybersecurity experts believe that Scattered Spider, a group of young men based in the US and the UK, was responsible for the MGM attack as well as a similar breach at rival Caesars Entertainment Inc. Caesars confirmed that they paid a ransom to the hackers, although Hornbuckle stated that he was not aware of the Caesars breach until after MGM had been targeted. The exact amount of the ransom demand was not disclosed.
As a result of the attack, MGM’s third-quarter earnings are expected to decrease by approximately US$100 million (RM472.65 million) and expenses will increase by US$10 million (RM47.26 million), most of which will be covered by insurance. During a panel discussion at the Global Gaming Expo in Las Vegas, Hornbuckle expressed concern about next year’s costs. Despite the challenges, MGM’s systems are now fully operational, with the exception of one server related to loyalty points. Hornbuckle expressed satisfaction with the decision not to pay the hackers, stating, “They’re not hanging over us with our database in their hand or ultimately the keys to the empire. And so we feel great about that part.” – Bloomberg
Credit: The Star : News Feed
