It appears that the July
2019 breach at MGM Resorts affected far more people than initially thought
The data breach at MGM
Resorts that we also wrote about earlier this year may have been far larger than previously
thought. In February, when the incident was disclosed, the estimated number of
guests impacted by the breach was 10.6 million; however, now it seems that as
many as 142 million hotel guests were affected by the incident that goes back
to July 2019.
This is after ZDNet reported that a hacker had posted an add on a dark web
criminal marketplace offering the personal data of more than 142 million former
MGM Resorts guests for some US$2,900 worth of cryptocurrency.
A spokesperson for the
hotel giant confirmed that the company knew about the size of the data breach.
“MGM Resorts was aware of the scope of this previously reported incident from
last summer and has already addressed the situation,” said the spokesperson,
before adding that the majority of the leaked data consisted of mostly contact
information, such as names, postal and email addresses.
The previous data dump
contained a range of Personally Identifiable Information (PII), including full
names, home addresses, phone numbers, emails, and birth dates. However, it did
not appear to contain financial information or booking details, nor did it
include any IDs or Social Security numbers. ZDNet was able to verify as much by
reviewing the records from February, as well as a new batch of 20 million
records that were released by the cybercriminals on Sunday. It also contacted
past guests to confirm the veracity of the information.
It is worth noting that the
leaked information could be enough for launching spearphishing campaigns
or SIM swapping attacks. The victim list even includes a long list of
potential high-profile targets, such as CEOs of tech companies, government
officials, and celebrities.
In recent years, several
other hotel operators – including InterContinental Hotels and the Trump Hotel Collection – have also fallen victim to similar
incidents. Marriott Starwood suffered a data breach that affected a whopping
500 million guests.
