Lauren Magarino
MGM Resorts cyberattack won't be the last; how to protect yourself
Attacks on MGM Resorts and Caesars took vacationers by surprise, but security experts predict more are coming, and show how to best protect yourself.
LEARN MOREPosted: 5:05 p.m. EDT Oct 1, 2023
Recent cyberattacks at MGM Resorts and Caesars Entertainment have been making headlines in the U.S.
MGM was hit with sudden outages at casinos, keycard issues for guests at hotels, and even fraudulent credit card charges for rewards members.
Soon after, the Wall Street Journal reported that Caesars Entertainment paid roughly $15 million in ransom money to its attackers, who, in exchange, promised not to release stolen customer data.
The attacks come on the heels of a reported hack of Clorox in August, which caused production delays and shortages on shelves that are still being felt a month later.
"So when you have really high security, hackers really don't challenge themselves to the high security; when there's weakness, that's what they are exploiting,” said Yoohwan Kim, a professor of computer science. "Usually that weakness is human-related, like phishing something, social engineering."
The cyberattack against MGM was a high-profile example of what is known as "vishing" or "voice phishing," where hackers impersonate an employee over the phone using publicly available information from sites like LinkedIn.
The Caesars hack seems to be an example of using "ransomware," a type of software hackers use to hold their victim's data hostage, blocking access until they agree to pay a ransom.
“100% protection. It's always impossible. So we have to think of limiting the damage. If it happens at this stage, at this stage, at this stage, how do we minimize it?" said Kim.
The attacks gained extra attention for tarnishing the 'image' of high-powered security at casinos and evoking Hollywood heist dramas like "Ocean's Eleven."
But the incidents are part of a larger pattern in recent years of major ransomware attacks across industries.
“Cyberattacks against U.S. healthcare and ransomware attacks are at an unprecedented level,” John Riggi of the American Hospital Association told NBC News.
Federal agencies, state governments, and major universities have been hit with a campaign of data theft and ransomware, according to CBS News.
Since many victims of attacks may never go public, there are no exact numbers for how many cyberattacks occur in the US regularly.
The latest IBM Data Breach Report revealed 83% of organizations experienced more than one data breach during 2022.
According to a report on data breaches by Verizon, the total number of ransomware attacks across industries has rapidly risen by 13%.
One 2021 estimate from Info Security Magazine says the average ransom payment has also increased—it more than doubled from 2019 to 2020.
One theory for the rise in cyberattacks has been the popularization of using ransomware since the mid-2010s.
The hackers can shut down and hold entire systems hostage, but now more often, they steal victims' data and threaten to release it on the black market.
Another theory has been the impact of the pandemic and increasingly remote networks. This opens up new, potentially easier targets for hackers, especially those using phishing or voice phishing.
Despite the rise in attacks, some experts say companies aren't protecting themselves as aggressively as they should.
This past July, an IBM survey of organizations that experienced a data breach found that only half planned on investing more in security.
The U.S. has an estimated nearly 700,000 job vacancies in cybersecurity.
Earlier this summer, the House Homeland Security Committee discussed the shortage and its national security implications: many major hacks are from foreign individuals or even state intelligence.
“In April, the FBI director testified to Congress that even if all FBI cyber agents and analysts focused on the China threat, Chinese hackers would still outnumber our FBI cyber personnel by at least 50 to 1. That is extremely concerning,” said Rep. Andrew Garbarino (R-NY).
With budget changes and worker shortages, cybersecurity teams will be facing an uphill battle if ransomware and other cyberattacks are set to only increase.
