MGM Resorts Cybersecurity Issue to Impact Q3 2023 Earnings

MGM Resorts International has revealed that the recent cybersecurity incident, which caused widespread disruptions across its North American operations, will have significant repercussions beyond damage to its reputation. The attack caused chaos and confusion among clients, with an upcoming lawsuit already in the works. Data breaches further exacerbated the issue, giving the hackers access to client information.

MGM Faced Challenges on Multiple Fronts

The leading international operator expects that the disruption caused by the cybersecurity incident will negatively impact its financial results for the third quarter of 2023, primarily affecting its Las Vegas operations. The estimated damage includes a reduction of approximately $100 million in Adjusted EBITDAR for September 2023 as the incident’s fallout continues to spread.

MGM incurred nearly $10 million in one-time expenses for the cybersecurity incident. These expenses encompassed technology consulting services, legal fees, and fees for other third-party advisors. Hotel occupancy for September decreased to 88%, compared to 93% in September 2022, as many customers preferred to wait for the matter to settle.

The data breach accompanying the attack also caused significant issues, giving the attackers access to information such as gender, date of birth, and driver’s license numbers. A smaller group of customers also had their Social Security numbers and passport numbers compromised. Fortunately, sensitive customer information, such as passwords, bank account numbers, or payment card details, was not leaked.

The Company Has Already Resolved Most Issues

MGM Resorts has taken measures to address the cybersecurity incident. Operations at the company’s domestic properties have mostly returned to normal, with vital guest-facing systems restored. The company is actively working to address any remaining issues, hoping to resolve them in the coming days. Despite the company’s swift actions, it will need more time and resources to deal with the incident’s long-term consequences.

Despite the significant damage to its reputation and bottom line, MGM Resorts is optimistic about a robust fourth quarter. The company expects record results in November, primarily driven by the Formula 1 event. Additionally, forecasts indicate that hotel occupancy will fully rebound in November for the Las Vegas Strip Resorts, finally signaling a return to normalcy.

Moody’s Investors Service recently categorized the cybersecurity incident as “credit negative” for MGM Resorts, underscoring the substantial risks such threats pose to the company’s operations. This event serves as a reminder of the importance of robust cybersecurity measures in the gaming and hospitality industry, proving that even leading operators must remain vigilant.