Breach Disclosure: MGM Properties

In February 2020, the personal information of nearly 10.6 million people who lodged at MGM Resorts hotels has been published on a popular hacking forum. The data in the breach contains information that could be abused by hackers in spear-phishing and SIM swapping attacks. The breach in total contained 10.6 million rows of data, with 3.1M unique email addresses.

Recommendations

Enable 2-factor authentication for all of your organization accounts to help mitigate phishing and credential stuffing attacks
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance

Details

In July 2019, MGM Resorts suffered a data breach impacting 10.6 million individuals and exposing 3.1M unique email addresses. A misconfigured cloud server is believed to be the source of the breach. According to an article by ZDNet, the breach includes personal and contact details of celebrities, tech CEOs, reporters, government officials, and employees at some of the world's largest tech companies. The breached information is available on a popular hacking forum, RaidForums.

The rows of the breach include:

Full names
Home addresses
Phone numbers
Emails
Dates of birth