In recent weeks, both MGM Resorts and Caesars, two major players in the gaming industry, have fallen victim to cyberattacks. According to sources familiar with the matter, Caesars paid a ransom of $15 million to a cybercrime group that infiltrated and disrupted its systems. The same group has also demanded a $30 million ransom from MGM. These attacks highlight the growing threat posed by cybercriminals, even to large companies in the United States.
Caesars reported the incident in a filing with the U.S. Securities and Exchange Commission, acknowledging the hack as a material event. Despite the ransom payment, Caesars does not expect it to have a significant impact on the company's bottom line. The costs will be partially covered by the company's cyber insurance policies.
The cybercrime group responsible for these attacks, known as UNC3944 or Roasted 0ktapus, has been linked to other attacks on companies such as Cloudflare, Okta, and Twilio. This group is considered a serious threat, with members who are native English speakers and highly effective social engineers.
It is worth noting that both MGM and Caesars have delayed filing reports on the cyberattacks, raising questions about their disclosure practices. The SEC has been pushing for stricter cybersecurity disclosure rules, which will require companies to disclose the nature of a cyberattack and its impact on the business within four days of the event. This new rule will come into effect by the end of the year.
These attacks serve as a reminder that cybersecurity is a critical issue for businesses, especially those in industries that handle sensitive customer information. As cybercriminals become more sophisticated, companies must invest in robust cybersecurity measures to protect themselves and their customers. The recent incidents in the gaming industry highlight the need for increased vigilance and proactive measures to prevent such attacks in the future.