Earlier this month Caesars Entertainment and MGM Resorts in Las Vegas reported cybersecurity attacks that led to data breaches and computer shutdowns. MGM has just recently booted computers back up 10 days after the incident.

Scattered Spider, the group believed to be behind the attacks, claimed they took six terabytes of data from the casinos, according to  Reuters. Driver’s License and Social Security numbers of employees and guests were reported to be a part of the breach. According to the  Washington Post, the attacks impacted ATM machines, slot machines, digital room keys, electronic payment systems, and at one point the casino was forced to check in guests with clipboards. 

Prior to the attack on MGM, the collective of hackers known as Scattered Spider became notorious for their SIM swap scams and phishing attacks on telecommunication companies. This time it is alleged they gained access to the company’s internal systems through the social engineering tactic of “vishing” or “voice phishing”. Vishing is most often used when calling IT departments and posing as an employee that the hackers have researched online. Once on the phone it is believed the group would ask for a password reset and/or login credentials.

This tactic has been proven to be far more successful as “The click rate for the average targeted phishing campaign was 17.8%, but targeted phishing campaigns that added phone calls (vishing or voice phishing) were three times more effective, netting a click from 53.2% of victims.” in 2022 according to an IBM Report. 

After the attack, Caesars Entertainment allegedly paid roughly $15 million to the hackers in an attempt to save the sensitive data and information from being leaked. It has not been reported if MGM has paid the ransom for their data. 

While $15 million is a large sum to be paid it is not the only cost associated with an attack of this scale. Eric Gregg, Director of Sales at Tx Systems, believes the cost associated with the investigation and future prevention of a cybersecurity attack on MGM and Caesar’s can cost millions of dollars as well. 

“Whenever a hack like this happens it costs millions of dollars. Companies pay millions of dollars to cybersecurity companies to figure out what happened, millions to make sure it doesn’t happen again, and millions more to monitor the ongoing credit scores of all their customers,” Gregg said. 

According to Business Insider, it caused losses of around $8 million a day to MGM during the 10-day attack.