Summary Bullets:

? On September 10th, casino giant MGM Resorts International was hit with a cybersecurity “issue” that impacted its hotel booking and restaurant reservation systems, as well as digital keys and corporate applications including its web site.

? The company acknowledged the incident in a Securities and Exchange (SEC) filing on September 12th which affected properties in several states including Maryland, Massachusetts, Michigan, Mississippi, New Jersey, New York, and Ohio.

On September 10th, an incident came to light that affected multiple MGM casino and hotel properties in a number of US states. The company issued a press release on September 12th and also filed an 8-K report with the SEC. An 8-K filing is a notification of an event that might have a material financial impact on a publicly-traded company.

The company said its statement it had “identified a cybersecurity issue affecting” some of its systems. It did not disclose specifically which systems or the nature of the event but guests reported issues with check-in, reservations, downed machines on casino floors and difficulty accessing their rooms using digital keys.

As of Tuesday, MGM said its casino floors were all operational but information about the event from the company is sparse. The FBI said it is investigating and the incident has not been resolved. Rumors are circulating that a ransomware group is responsible, leveraging social schmalineering but neither the FBI or MGM has confirmed that.

Credit rating agency Moody’s said that the incident points out “key risk” in the company’s operations and could result in a downgrade in MGM Resorts International’s credit rating. This is not the first time the company has suffered a very public and damaging breach. Three years ago, MGM admitted the personal information of 10 million customers had been stolen and published on a hacking forum.

The incident comes at a time when ransomware attacks are becoming more frequent and more costly for targeted companies. According to research from security vendor ZScaler, ransomware related attacks have risen 37% this year versus last. The average payment is now more than $100,000 but the average demand is $5.3 million. This summer the SEC voted on new disclosure rules in place that require more transparency in the event of a cybersecurity breach or other incident. The new disclosure rules do not go into effect until December.