Source: MGM Resorts refused to pay hackers' ransom in the September cyberattack; filing: MGM says the hack will have a $100M negative impact on its Q3 earnings
Fallout will have a $100 million negative impact on quarterly earnings, Las Vegas-based company says
Context & Ripple Effects
The incident had already disrupted MGM systems across its U.S. casino and hotel properties, with its website remaining unavailable for more than 60 hours in related coverage. This filing turns that operational outage into a disclosed financial cost.
The episode also exposed divergent ransomware responses: Caesars reportedly paid hackers after its own breach, while MGM declined to do so. Later coverage of a $45M settlement tied partly to the 2023 attack shows that the incident’s costs were not confined to the initial disruption.
First-order effects
- MGM absorbs an estimated $100M hit to Q3 earnings while restoring operations rather than paying the attackers’ demand.
- Investors and customers get a clearer measure of the commercial damage from the systems outage at MGM properties.
Second-order effects
- Casino and hospitality operators face a sharper incentive to assess whether their outage-response plans can limit revenue losses during a cyber incident.
- The contrast with Caesars’ reported payment makes ransom refusal a business-continuity decision as well as a security posture, increasing scrutiny of each operator’s recovery capability.
Third-order effects
- If major service businesses continue to disclose material outage costs, cyber resilience may be evaluated more directly as an operating and financial-control issue rather than solely an IT expense.
- The later litigation settlement suggests the economic exposure from a breach can extend from interrupted operations into customer claims, potentially raising the value of prevention and incident-response preparedness.
The trend: Ransomware is increasingly becoming a measurable business-interruption risk for consumer-facing companies, with consequences that can outlast the initial systems outage.