MGM Resorts Reports System Shutdown Due to Cyberattack
MGM Resorts Shuts Down Systems to Contain Unspecified Cyberattack
Impact Scope
Affected Companies
Industries Affected
Related Entities
Other
Full Report
Executive Summary
On September 23, 2026, MGM Resorts International, a global leader in hospitality and entertainment, announced it had identified a cyberattack within its technology environment. In response, the company took immediate containment measures by shutting down certain computer systems. This proactive step has led to operational disruptions, though the full extent is not yet public. The company is currently investigating the incident with the assistance of cybersecurity experts. The identity of the attackers and the scope of any potential data exfiltration remain unknown at this time.
Threat Overview
The incident at MGM Resorts is a developing cyberattack with limited public information. The company's decision to shut down systems indicates a serious event, likely aimed at preventing the spread of malware, such as ransomware, or stopping active data exfiltration. The initial access vector and the specific systems affected have not been disclosed. Such attacks on hospitality giants are often financially motivated, targeting payment systems, customer databases containing personal information and loyalty program data, or aiming for wide-scale disruption via ransomware.
Technical Analysis
While details are unconfirmed, attacks on large enterprises like MGM often follow a common pattern involving credential theft, lateral movement, and data encryption or exfiltration. Based on typical TTPs used in such incidents, the attack may have involved:
Potential MITRE ATT&CK Techniques (Analyst Assessment)
- T1566 - Phishing: A likely initial access vector, targeting an employee with a malicious email to steal credentials.
- T1078 - Valid Accounts: Once initial credentials are stolen, attackers use them to log in and appear as legitimate users.
- T1046 - Network Service Discovery: After gaining access, attackers would scan the network to identify critical systems like reservation databases, domain controllers, and backup servers.
- T1486 - Data Encrypted for Impact: If this is a ransomware attack, the final stage would involve encrypting critical systems to disrupt operations and demand a ransom.
- T1537 - Transfer Data to Cloud Account: Many modern extortion groups steal data before encryption. Attackers could be exfiltrating customer PII or financial data to a cloud storage account.
Impact Assessment
The shutdown of systems at a company of MGM's scale can have cascading operational and financial impacts:
- Operational Disruption: Inability to process new hotel reservations, check-ins, or casino payments. Digital room keys and other guest services may be affected. This directly impacts revenue and customer experience.
- Data Breach: Potential compromise of sensitive customer data, including names, contact information, passport details, and credit card numbers. This could lead to regulatory fines and class-action lawsuits.
- Reputational Damage: A major cyberattack can erode customer trust, impacting future bookings and brand loyalty.
- Financial Loss: Costs associated with incident response, system restoration, potential ransom payments, regulatory fines, and lost business can amount to tens or hundreds of millions of dollars.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) are available at this time.
Cyber Observables — Hunting Hints
Security teams at similar organizations can hunt for precursor activity. The following patterns could indicate related activity:
powershell.exe, psexec.exe, wmic.exeDetection & Response
MGM's immediate response to shut down systems is a key part of the 'Evict' phase of incident response.
- Detection: Organizations should deploy an EDR solution to detect malicious processes and behavioral anomalies. SIEM systems should be configured to correlate logs from various sources (network, endpoint, identity) to detect attack sequences. This aligns with D3FEND techniques like
D3-PA - Process Analysis. - Response: The primary goal after detection is containment. MGM's action to isolate systems is a textbook example. Following isolation, the focus shifts to investigation (forensics to determine root cause and scope), eradication (removing the attacker's presence), and recovery (safely restoring systems from backups). This process involves D3FEND's
D3-NI - Network IsolationandD3-FR - File Restoration.
Mitigation
To prevent similar attacks, hospitality organizations should prioritize:
- Multi-Factor Authentication (MFA): Implement MFA on all remote access points, administrative accounts, and critical applications to protect against credential theft.
- Network Segmentation: Segment networks to separate critical systems (e.g., property management systems, payment gateways) from the general corporate network. This limits an attacker's ability to move laterally.
- Immutable Backups: Maintain offline and immutable backups of critical data and systems. Regularly test the restoration process to ensure a swift recovery from a ransomware attack.
- Incident Response Plan: Develop and regularly test a comprehensive incident response plan. Tabletop exercises can ensure that all stakeholders know their roles and responsibilities during a crisis.
Timeline of Events
MITRE ATT&CK Mitigations
Multi-factor Authentication
Protects against the use of stolen credentials, a common vector in major breaches.
Network Segmentation
Limits the blast radius of an attack, preventing attackers from moving from less sensitive systems to critical ones.
Enables detection of anomalous activity through comprehensive logging and monitoring.
Update Software
Patching vulnerabilities is crucial to prevent initial access and lateral movement.
D3FEND Defensive Countermeasures
In a complex environment like MGM Resorts, Network Isolation (segmentation) is a critical proactive and reactive control. Proactively, guest-facing networks (Wi-Fi), corporate IT networks (employee workstations, email), and operational systems (property management, payment processing, gaming floors) must be strictly segregated. Firewalls between these segments should enforce a default-deny policy, only allowing explicitly required traffic. Reactively, as demonstrated by MGM, the ability to quickly isolate affected segments or the entire network is crucial for containment. This prevents ransomware from spreading or attackers from pivoting to other parts of the business. An effective segmentation strategy would mean a compromise on the corporate network could not easily traverse to the point-of-sale systems, limiting the immediate financial and data breach impact.
For a business like MGM that relies on constant system availability, a robust File Restoration capability is non-negotiable. This goes beyond simple backups. Organizations must implement the 3-2-1 rule (3 copies, 2 different media, 1 offsite/offline). One of these copies should be immutable or air-gapped, meaning attackers who gain administrative access to the network cannot delete or encrypt it. In the context of the MGM attack, having tested, immutable backups of their reservation systems, customer databases, and property management systems is the key to recovery. It allows the organization to restore operations without considering a ransom payment, significantly reducing the attacker's leverage. Regular, automated testing of these backups is essential to ensure they are viable when a real incident occurs.
Process Analysis, typically performed by an Endpoint Detection and Response (EDR) solution, is vital for detecting attacks before they reach the impact stage. In an environment like MGM's, an EDR agent should be deployed on all endpoints and servers, including those running point-of-sale and property management software. The EDR tool should be configured to detect and alert on common attacker behaviors, such as a non-IT process like winword.exe spawning a powershell.exe shell, or lsass.exe memory being dumped to disk (a credential theft technique). By analyzing process parent-child relationships and command-line arguments, security teams can spot the abuse of legitimate tools for malicious purposes, providing an early warning that an attacker is active in the network and allowing for intervention before systems are encrypted or data is stolen.
Timeline of Events
MGM Resorts International identifies a cyberattack and shuts down some systems to contain it.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.