Summary Bullets:

? Reports surfaced that both MGM Resorts international and Caesars Entertainment had been hit with ransomware demands earlier this month.

? This comes in a year when both the frequency and cost associated with ransomware demands have skyrocketed.

Earlier this month both MGM Resorts International and Caesars Entertainment were targets of ransom demands. Caesars disclosed that it quietly paid off $15 million to hackers who had breached its customer loybetagty database, negotiated down from the initial $30 million demand. MGM went the opposite route, refusing to pay hackers who took over its Okta authentication servers. The result was a multi-system outage that affected everything from reservation systems and digital room key processes to casino floor operations for at least ten days. Continue reading “As Ransomware Attacks Accelerate in Frequency and Severity, How to Respond is Just One of the Questions” →

Summary Bullets:

? On September 10th, casino giant MGM Resorts International was hit with a cybersecurity “issue” that impacted its hotel booking and restaurant reservation systems, as well as digital keys and corporate applications including its web site.

? The company acknowledged the incident in a Securities and Exchange (SEC) filing on September 12th which affected properties in several states including Maryland, Massachusetts, Michigan, Mississippi, New Jersey, New York, and Ohio.

On September 10th, an incident came to light that affected multiple MGM casino and hotel properties in a number of US states. The company issued a press release on September 12th and also filed an 8-K report with the SEC. An 8-K filing is a notification of an event that might have a material financial impact on a publicly-traded company.

Continue reading “MGM Under Fire After a “Cybersecurity Issue”” →

Summary Bullets:

? The SEC released new rules on the expediency and response detail required of public companies in reporting cybersecurity incidents after a comment period.

? The rules were met with a mix of concern and criticism, including from two SEC commissioners who expressed dissenting opinions, raising red flags around the reporting requirements potentially revealing key elements of the breached organization’s defenses that could put them at risk of another attack and going beyond the agency’s authority.

In an intensifying threat environment, the US SEC posted new rules requiring how and when public companies will report security incidents that have a material impact on their operations. The new SEC rules oblige organizations to disclose a cybersecurity incident within four days of determining that the event had a material impact on the business. The guidelines state breached organizations are also compelled to outline their practices for detecting, assessing, and managing material risks from cybersecurity threats. The breached organization will need to also reveal prior incidents. The SEC is holding foreign companies conducting business in the US to the same standard. The rules do allow disclosure to be postponed if the US attorney general decides that immediate posting of the incident would put national security or public safety at risk.

Continue reading “New SEC Cybersecurity Disclosure Rules Raise Questions and Criticism” →

Summary Bullets:

? The Verizon Data Breach Investigations report (DBIR) revealed a sizeable jump in pretexting while ransomware continues unabated.

? While actors external to the breached organizations are responsible for most incidents, 19% of the either intentional or accidental security events are perpetrated by internal staff.

With contributions from dozens of organizations including law enforcement agencies like the US Federal Bureau of Investigation (FBI), Verizon’s 2023 DBIR offers insight into the nature of current threat landscape through the analysis of more than 16,000 security incidents, 5,199 of which were confirmed data breaches. What the report reveals is an environment dominated by profit-motivated bad actors who continue to advance techniques in areas like social schmalineering that exploit human susceptibilities.