STRIKE0 / OFFENSIVE SECURITYAUTONOMOUS RED TEAMING / HUMAN-DIRECTED
PUBLIC INCIDENT DOSSIER / SEP 2023
DISRUPTION / SEC-FILED ESTIMATE

MGM Resorts
Security incident.

MGM forecast an approximately USD 100 million negative impact on Q3 adjusted property EBITDAR from a cybersecurity incident.

~$100M
ESTIMATED ADJUSTED PROPERTY EBITDAR IMPACTEstimated profit-metric effect, not ransom or cash theft. EBITDAR is a company-defined operating performance metric.All incidents ↗
01 / DOCUMENTED FINDINGSPUBLIC-SOURCE ANALYSIS
WHAT HAPPENED

What the evidence shows.

Its SEC 8-K linked the disruption to operating systems and guest-facing services at domestic properties, with further one-time costs disclosed separately.

MEASUREMENT / INTERPRETATION

What the number means.

Estimated profit-metric effect, not ransom or cash theft. EBITDAR is a company-defined operating performance metric.

CONTROL QUESTIONS

How to test resilience.

Availability testing of reservations, access pathways, identity controls and safe recovery of customer-facing systems.

Read cited source ↗
TURN LESSONS INTO VALIDATION

Find the path before an attacker does.

Discuss a scoped assessment ↗