![](\"https:\/\/www.insurancejournal.com\/app\/uploads\/2023\/10\/MGM-las-vegas-Bloomberg-580x387.jpg\")
<\/p>\n![](\"https:\/\/www.insurancejournal.com\/app\/uploads\/2023\/10\/MGM-las-vegas-Bloomberg-scaled.jpg\")
<\/div>\nMGM Resorts International Chief Executive Officer Bill Hornbuckle chose not pay a ransom to hackers who broke into his casino chain\u2019s computer system because they didn\u2019t ask for money until well after the company discovered the attack.<\/p>\n
The intruders moved through MGM\u2019s systems for several days before sending a ransom note, Hornbuckle said in an interview Tuesday. The attack was so far along and the company had already begun rebuilding systems that were pulled offline that Hornbuckle chose to not even respond to the hackers.<\/p>\n
\u201cI\u2019d love to tell you there was this, you know, \u2018a jump on a white horse moment and devil be damned \u2014 we\u2019re not paying these bastards,’\u201d Hornbuckle said. \u201cThe reality is because we caught this so early and we were on them.\u201d<\/p>\n
MGM, the largest owner of casinos on the Las Vegas Strip, estimates the hack began on the evening of Sept. 7. The company tried to shut down systems before the attackers could steal any data, but they ultimately got into the corporate Domain Name System (DNS) layer, which helps run all of a company\u2019s applications and can be used to deploy malware.<\/p>\n
\u201cThey had gotten into the arteries to the heart so they could choke things off,\u201d Hornbuckle said.<\/p>\n
Related:<\/strong> Group in Casino Hacks Skilled at Duping Workers for Access<\/a><\/p>\n Management created a war room that included executives, IT professionals, lawyers and cyber-security consultants. Employees working with guests began operating in manual mode, writing down customers\u2019 names and credit-card info on clipboards at check-in. Slot machine patrons were paid out in cash by attendants rather than via paper vouchers.<\/p>\n It wasn\u2019t until days later that the hackers sent a ransom note. By that point, the attackers were knocking core systems offline, including payroll, purchasing and phones, and a booking system that handles 20,000 reservations a day.<\/p>\n \u201cLiterally everything was out,\u201d Hornbuckle said. \u201cThey clearly got wind of what we were doing and closed us down in the balance.\u201d<\/p>\n Scattered Spider, a group of young men based in the US and the UK, is believed by cyber-security experts to have instigated the MGM attack, as well as a similar incursion at rival Caesars Entertainment Inc.<\/p>\n After the MGM attack, Caesars confirmed it paid a ransom to hackers. Hornbuckle said he wasn\u2019t aware of the Caesars breach until after MGM was hit. He declined to disclose the amount of the ransom demand.<\/p>\n The incident will reduce MGM\u2019s third-quarter earnings by about $100 million and add $10 million to expenses, most of which will be covered by insurance.<\/p>\n \u201cI can only imagine what next year\u2019s bill will be,\u201d Hornbuckle said on a panel Tuesday at the Global Gaming Expo, a trade show in Las Vegas.<\/p>\n Four weeks in, the casino giant\u2019s systems are fully operational, apart from one server relating to loyalty points, Hornbuckle said. He\u2019s also glad he made the decision not to pay.<\/p>\n \u201cThey\u2019re not hanging over us with our database in their hand or ultimately the keys to the empire,\u201d he said. \u201cAnd so we feel great about that part.\u201d<\/p>\n Photo: Photographer: Roger Kisby\/Bloomberg<\/em><\/p>\n Topics<\/span> Cyber<\/a> <\/p>\n<\/p><\/div>\n Was this article valuable?<\/p>\n<\/p><\/div>\n