MGM Resorts ended its 10-day computer shutdown on September 20, after a September 7 hack, and says that “all of our hotels and casinos are operating normally”
MGM Resorts brought to an end a 10-day computer shutdown prompted by efforts to shield from a cyberattack data including …
Context & Ripple Effects
MGM’s recovery closes an outage that had first been described as a cybersecurity issue affecting systems across its U.S. casino and hotel properties, then escalated into a website outage lasting more than 60 hours. The episode made a cyber incident immediately visible to guests and on-site operations.
The disruption also follows MGM’s earlier exposure of guest data from pre-2018 hotel stays, underscoring that the company’s cyber risk spans both data protection and business continuity.
First-order effects
- MGM can resume normal hotel and casino operations after 10 days of system disruption, reducing the immediate friction for guests and frontline staff.
- Restoring systems should end the need for workarounds such as manual transaction processing where payment kiosks had been unavailable.
Second-order effects
- The outage gives MGM a concrete test case for hardening recovery procedures and isolating essential property systems, rather than treating cybersecurity solely as a data-security function.
- Other hospitality and gaming operators face a clearer operational benchmark: a compromise of shared digital systems can interrupt booking, payments, and on-property service simultaneously.
Third-order effects
- If attacks continue to disrupt physical-service businesses, cyber resilience will increasingly be judged by recoverability and continuity of customer operations, not only by whether data was accessed.
- The combination of this outage and MGM’s prior guest-data exposure points to a broader need for integrated governance of customer data, identity controls, and operational systems; the corpus does not establish which controls MGM will adopt.
The trend: Cybersecurity incidents are becoming business-continuity events for companies whose customer service, payments, and physical operations depend on interconnected systems.