Security Insights from the MGM & Caesars Cyber Attacks ??

MGM Resorts International announced that its recent cyber attack, which disrupted operations, will result in a $100 million impact on its third-quarter financials. The company promptly halted its systems upon detecting the attack to minimize the extent of the damage. Additionally, it anticipates incurring an extra one-time cost of around $10 million for remediation efforts in the quarter ending on September 30.

The personal information of customers who utilized MGM services before March 2019, including contact details, gender, date of birth, and driver's license numbers, was compromised, as confirmed by the company.

Just prior to MGM experiencing a cyberattack that took down its computer systems, Caesars, another casino operator, reportedly paid a $15 million ransom to a cybercrime group that successfully infiltrated and disrupted its own systems, sources familiar with the situation informed CNBC.

According to the same sources, this cybercrime group has also issued a ransom demand to MGM. These incidents mark two significant and highly disruptive attacks on the gaming industry within a short span of time.

The cybercriminals initially demanded a $30 million ransom from Caesars, but the company ultimately agreed to pay roughly half of that amount, as per the sources. Caesars' cyber insurance policies will partially offset the costs.

The recent cyber attacks on industry giants Caesars Entertainment and MGM Resorts International have raised pressing questions on the vulnerabilities existing in the sector and the way forward. ?As leading cyber experts, we took the time to unravel the intricate details of these attacks, the exploited systemic vulnerabilities, and the strong cybersecurity measures that stand as the industry's best bet in defending its assets.?

What Happened with the Casino Cyber Attacks??

The casino industry recently witnessed unsettling waves of cyber-attacks orchestrated by an aggressive and sophisticated criminal coalition identified as “Scattered Spider.” Collaborating with the Russia-based operation ALPHV, this group launched a mission to breach the casino giants, leaving a trail of distrust and significant financial ramifications.?

Caesars Entertainment?- a name synonymous with luxury and entertainment, came under the radar of these cyber criminals. The casino reported a breach on September 7, potentially compromising the personal information of a massive customer base involved in its loyalty rewards program. Despite the company's efforts to contain the damage, uncertainties loom regarding the long-term security and integrity of the compromised data. The evolving landscape of cybersecurity threats means that new vulnerabilities may emerge, requiring ongoing vigilance and adaptive security measures. Additionally, the potential for unauthorized access or the use of compromised information by cybercriminals remains a concern, highlighting the need for a comprehensive and sustained response to safeguard both the company and its valued customers.?

At the same time,? MGM Resorts faced disruptions that spanned across its resorts and casinos in the US, attributed to a calculated cyber offensive that started with a social engineering breach targeting the company's IT help desk. The incident spiraled into a more complex intrusion involving impersonations and network compromises that shook the foundations of the firm's cybersecurity infrastructure.?

How Did the Casino Cyber Attacks Happen??

Social Engineering and IT Help Desks?

At the epicenter of these attacks lay sophisticated social engineering strategies meticulously deployed to infiltrate the IT infrastructures of the targeted companies. The attackers exhibited prowess in exploiting human vulnerabilities, coaxing individuals at the IT help desks to reset multifactor authentication (MFA) settings, thus paving the way for a deeper incursion into the networks.?

David Bradbury, Chief Security Officer at Okta, highlighted the method involving low-tech social engineering tactics to gain initial access, escalating into advanced impersonations within the network. “The human part was simple, but the subsequent part of the attack was complex,” he says.?

The warning bells had been sounded earlier, with advisories pointing to similar tactics deployed against high-privileged users, illustrating the evolving landscape of cyber threats where even seemingly simplistic strategies can yield profound results.?

Exploiting Weak Links?

A closer inspection of the attacks reveals an effort to exploit the perceived weak links within the organizations. The help desks emerged as significant points of vulnerability, with protocols allowing relatively easy access to password resets based on easily obtainable personal details.???

This glaring loophole points to the necessity of reinforcing even the basic layers of cybersecurity to counteract adept criminals who are constantly evolving their strategies. Regular security audits, robust encryption protocols, multifactor authentication, and ongoing employee training are critical in cultivating a culture of heightened cybersecurity awareness and resilience.?

?Furthermore, the offensive on Caesars highlighted another area of vulnerability – outsourced IT support vendors. The attackers managed to breach the network through a social engineering attack on an unnamed vendor, illustrating the pressing need for robust vendor risk management protocols.??

Many companies rely on a network of suppliers and vendors for essential functions and aren't aware of the security risks it may entail. You should include vendor security training for any employees who work with or are in contact with vendors so they can learn how to identify risks such as vendor impersonation fraud. Download our free white paper here and share it with your team.??

When it comes to selecting your vendors, be sure to conduct thorough background checks, evaluate the vendor's cybersecurity practices, and set clear expectations for compliance with industry-standard security protocols. Moreover, any contractual agreements should include specific clauses regarding data protection and incident response procedures to ensure that vendors are held accountable in the event of a breach.?

The Financial Repercussions: Ransoms and Data Security?

Post-intrusion, the criminal syndicate adopted an aggressive stance, threatening to release sensitive data and coercing the companies into a financial settlement to prevent data leaks. Reports suggest that tens of millions were paid to contain the situation, raising ethical and financial dilemmas on the efficacy of such measures.?

This financial aspect brings forth the concept of “pinky promises,” as described by Brett Callow, a threat analyst at Emsisoft. Organizations often find themselves in a predicament, negotiating with criminals for the security of their data, albeit with no guarantee of the data’s safety post-payment. The ramifications of such financial transactions echo far beyond the immediate financial loss, raising concerns over data security and ethical boundaries.?

Scattered Spider & ALPHV: The Collaborative Menace?

The collaborative effort between Scattered Spider and ALPHV represents a growing trend of cyber-criminal syndicates pooling resources and expertise to orchestrate large-scale cyber offensives. Scattered Spider, also known as UNC3944, showcases a blend of adept individuals based primarily in the US and UK, some as young as 19, bringing a dynamic and contemporary approach to cyber-criminal activities.??

Their collaboration with ALPHV, a group believed to be based in Russia, amplifies the threat potential, merging diverse skill sets and geographic locations to form a formidable force in the cyber underworld. This union raises alarm bells, calling for a concerted effort from cybersecurity firms globally to counteract such emerging threats.?

The Cyber Underworld: A Hub of Collaborations and Innovations?

In the dark recesses of the cyber underworld, groups such as Scattered Spider and ALPHV constantly evolve, innovating their tactics and expanding their networks. They operate in a space where knowledge sharing and collaborations are commonplace, fostering an environment that nurtures criminal ingenuity and agility.?

These groups exploit the anonymity offered by the dark web, leveraging it as a platform to coordinate attacks, share insights, and even claim responsibility for their actions, as witnessed in the recent attacks where ALPHV claimed credit and countered rumors regarding the involvement of teenagers from the US and UK.?

?As we navigate this complex landscape, it becomes crucial to understand the dynamics of these criminal networks and to develop strategies that can effectively counteract their evolving tactics.??

The Repercussions Beyond Financial Loss?

Impact on Brand Equity and Customer Trust?

Cyber-attacks often leave a lasting impact on the brand equity and trust that organizations have built over the years. Customers entrust companies with their personal data, expecting strict measures to safeguard their privacy. Incidents such as these shake the foundation of trust, potentially leading to customer attrition and tarnishing the brand image, as it did for T-Mobile. ?

T-Mobile has been in the headlines numerous times in the last few years, and not for good reasons. Since 2018, T-Mobile has suffered nine breaches affecting millions of customers and resulting in an ongoing class action lawsuit and a loss of customer trust. Thankfully, the company has since reported substantial progress and backed its statement by pledging $150 million toward enhancing its cybersecurity.?

Regulatory Scrutiny and Legal Repercussions?

The casino industry operates within a legal framework that demands adherence to data protection regulations. Cyber incidents of such magnitude can attract regulatory scrutiny, with potential legal repercussions that can translate to hefty fines and sanctions. These incidents bring forth the pressing need for compliance with data protection regulations and the implementation of robust cybersecurity protocols to prevent such breaches.?

Here, the NIST Cybersecurity Framework (NIST-CSF) stands as a valuable resource. It provides a comprehensive set of guidelines and best practices for organizations to manage and mitigate cybersecurity risks effectively. By adopting the NIST-CSF, casinos and other entities within the industry can systematically assess their cybersecurity posture, identify vulnerabilities, and implement measures in alignment with industry-recognized standards.??

This framework not only bolsters their security defenses but also demonstrates a proactive commitment to regulatory compliance, potentially mitigating legal consequences in the aftermath of a breach. It serves as a strategic roadmap for developing and maintaining a resilient cybersecurity posture, safeguarding both sensitive customer data and the reputation of the organization.??

Industry-Wide Ramifications?

The repercussions of such attacks echo across the industry, setting a precedent that can influence operational strategies and investments in cybersecurity across players in the sector. Companies are now urged to rethink cybersecurity strategies, acknowledge the evolving nature of threats, and adopt proactive measures to safeguard assets.?

Economic Implications?

From an economic perspective, such cyber incidents can have broader repercussions on the industry and the economy. The financial losses incurred, coupled with potential dips in stock prices and investor confidence, can translate to substantial economic ramifications, underscoring the importance of strong cybersecurity measures in sustaining economic stability.??

How to Avoid Incidents like the Casino Cyber Attacks

Strengthen Authentication Processes?

A foundational step in building an impactful cybersecurity infrastructure involves strengthening authentication processes. Implementing multifactor authentication with stringent verification checks can act as the first line of defense against social engineering attempts. This measure demands a cultural shift within organizations, nurturing a spirit of vigilance and awareness regarding the evolving nature of cyber threats.??

Invest in Robust Training and Awareness Programs?

A proactive approach to cybersecurity involves the cultivation of robust training and awareness programs that equip staff with the necessary skills to identify and counteract potential phishing attempts. These programs should encompass various facets of cyber threats, including SMS text phishing, a tactic frequently deployed by groups such as Scattered Spider.?

In-depth training sessions should cover not only the technical aspects of recognizing suspicious emails or messages but also the psychological tactics used by cybercriminals to manipulate human behavior. Employees should be educated about the telltale signs of phishing, such as unfamiliar senders, requests for sensitive information, or urgent language designed to induce hasty actions. Simulated phishing exercises can be invaluable in providing practical, hands-on experience, allowing employees to practice their responses in a controlled environment.?

Vendor Risk Management?

The recent attacks brought to light the vulnerabilities associated with outsourced IT support vendors. This revelation underscores the need for rigorous vendor risk management protocols, scrutinizing the cybersecurity measures of third-party vendors, and ensuring compliance with stringent cybersecurity standards.?

Outsourcing services is common and allows organizations to tap into specialized expertise and resources. However, this practice also introduces an additional layer of risk. Companies must treat their vendors' cybersecurity practices with the same level of scrutiny as they do their own.?

Conducting thorough due diligence when onboarding vendors is the first line of defense. This includes comprehensive assessments of their cybersecurity policies, procedures, and infrastructure. It's imperative that vendors have robust security measures in place, including firewalls, encryption protocols, and intrusion detection systems. Their incident response plans and disaster recovery capabilities should be evaluated, as a vendor's ability to respond to a breach quickly can directly impact the security of the organization they serve.??

Advanced Analytical Tools?

In the arms race against cyber criminals, the deployment of advanced analytical tools stands as a critical component in building a resilient defense infrastructure. These tools, leveraging machine learning and real-time analytics, can detect and counteract threats dynamically, evolving concurrently to stay ahead of the adversaries.?

Real-time analytics can enhance an organization's ability to respond effectively to cyber threats. By processing and analyzing data in real-time, security teams gain immediate insights into potential breaches or suspicious activities. This allows for rapid decision-making and timely intervention, potentially mitigating the impact of an attack.?

Additionally, the integration of threat intelligence feeds into these analytical tools and enhances their effectiveness. By leveraging up-to-date information on known threats, attack vectors, and cybercriminal tactics, organizations can proactively adjust their defenses to counteract emerging threats.?

Incident Response Plan?

Developing a detailed incident response plan emerges as a vital element in the blueprint for strong cybersecurity. This plan, outlining the steps necessary for swift action during a breach, can potentially limit the damage and secure critical data, acting as a safety net in times of crises.?

The incident response plan serves as a structured guide, providing a clear roadmap for the organization to follow in the event of a security incident. It outlines the roles and responsibilities of key personnel, ensuring that everyone understands their specific tasks and how they contribute to the coordinated response. This level of clarity is invaluable in high-pressure situations, enabling a more efficient and effective response.?

Furthermore, the plan should incorporate a thorough risk assessment, considering potential vulnerabilities, likely attack vectors, and the potential impact of various types of breaches. This assessment allows for the prioritization of response efforts and the allocation of resources to the areas most in need.?

If you're not sure where to begin, download our free incident response plan template.?

Prioritize Peace of Mind

Your peace of mind and your company's future are worth every effort. Contact us?today if you're searching for a holistic approach that ensures your cybersecurity strategy aligns with your organization's unique needs and challenges.??