8 ms·

MGM expects $100M hit from hack that led to data breach

90 points by isaacfrond 3y ago

waihtis 3y ago
Another noteworthy newspiece of large loss caused by a cybersecurity incident came from Clorox*: > the incident had disrupted portions of the company's IT infrastructure... The company expects a loss per share of between 35 cents and 75 cents in the quarter ended on Sept. 30, and for net sales to fall by 23% to 28% from a year earlier. It had reported profit of 68 cents per share in the year-ago period. Still, you see CISOs fight tooth and nail to get a couple million approved for boosting cybersecurity posture. https://www.reuters.com/business/retail-consumer/clorox-expects-quarterly-loss-hit-cyberattack-2023-10-04/ https://www.reuters.com/business/retail-consumer/clorox-expe...
- toomuchtodo 3y ago
  The financial impact will continue until culture and budgets improve. The folks making these decisions are not sophisticated and competent in risk management. EDIT: @RugnirViking, my brother in christ, I agree with everything you said about culture.
  - RugnirViking 3y ago
    > The folks making these decisions are not sophisticated and competent in risk management Aren't they pretty good at financial risk? isnt that like their only job a lot of the time? Idk it seems to me it must be possible to make a good argument for this stuff - How do cybersecurity consulting firms pitch to clients? Could McKinsey etc get in on it? It's just hard internally because a lot of the time it requires the culture to have been there from the beginning. Changing the culture if it's not present already is like trying turning a supertanker with a desk fan. People resent loss of freedoms, and operational restrictions prevent getting everyone to understand the whys
  - dvh 3y ago
    No, it will not improve. They will be slowly replaced by companies with better security.
    - red-iron-pine 3y ago
      risk vs. reward. as long as they still control the bleach and misc. chemical market, it's just a cost of doing business.
  - supportengineer 3y ago
    Perhaps SRE's would make the best CEO's
    - deleted 3y ago
      [deleted]
  - wongarsu 3y ago
    "The company's shares fell 2% in extended trading after the outlook was released." That's a pretty mild impact. Multiply that with the low probability of this actually happening to a given company, and taking the risk doesn't sound sooo bad. Obviously it went wrong in this case, but it's hard to tell from the outside if that's because they did bad risk management or because they got unlucky on a calculated risk.
  - cj 3y ago
    Is it a given that the loss isn’t covered by insurance? There’s always a balance of risk and the cost of mitigating risk. One way to mitigate risk is simply buying an insurance policy which in many cases may be cheaper than paying a security firm to protect yourself proactively. Cyber insurance often includes things like coverage for a PR firm to help regain as much reputational damage that may have been incurred. Many cyber insurance plans also includes coverage for paying ransoms. (I’m playing devils advocate somewhat, buying insurance to protect against cyber is something companies should do alongside of taking a proactive approach to securing systems)
    - toomuchtodo 3y ago
      I am responsible for negotiating a cyberinsurance policy for a fintech, and the marketplace is drying up due to risk repricing. If it was my money, I wouldn't be backstopping anyone getting underwritten unless I can plug directly into their controls and observability systems to confirm their risk posture, as well as have an internal (to the insurer) IR team. I'd probably also require quarterly IR tabletops and red teaming without prior notification required. Less around process and attestation, more about real world validation. https://news.bloomberglaw.com/insurance/as-cyber-insurance-dries-up-treasury-department-eyes-a-backstop https://news.bloomberglaw.com/insurance/as-cyber-insurance-d... (I have also provided comments to the US Treasury on backstopping cyberinsurance and perverse incentives around doing so)
      - cj 3y ago
        Typically when applying for cyber insurance you submit a questionnaire which includes questions like “do all endpoints us AV” and “Do you use IDS on your network” etc, etc. To a certain extent insurance shouldn’t need to verify controls if they’re able to have a company fill a questionnaire, and if their answers aren’t accurate the insurance carrier can use that as a basis for denying the claim. I would hope any federal program (if one comes about) works similarly. “We will only cover incidents if we can verify after the fact that you had these controls and mitigation measures in place prior to the attack”
        3y ago
- Veserv 3y ago
  As any competent security executive would tell you, even if they had a unlimited budget, complete management support, all recommendations followed, and total control over business process short of utterly crippling operations, the cost of hiring a hacker to completely breach the best possible form of their system would still be less than 1 M$. Oh, but what about the banks? Yeah, those are the security executives who personally told me and my colleagues that when asked. They literally have 100 M$ budgets up to 1 G$ budgets and they said that. The problem is not money, the problem is that commercial IT security technology and vendors do not work against professional, financially-motivated threat actors.
  - wepple 3y ago
    I disagree. With sufficient buy-in and money, you can make your systems extremely difficult and costly to attack, making the economics of an attack not worth it. I’m willing to bet that a place like MGM has utterly abysmal security. You don’t see regular attacks against top-tier companies because a lot of them invest a reasonable amount.
  - waihtis 3y ago
    You're not wrong, but reading the autopsies of most of these 100M dollar incidents suggest that having a slightly above average detection posture would eliminate most of the damage.
    - Veserv 3y ago
      Sure, in many of the post-mortems you can see that the attack probably only cost something like 10 K$ to execute. If their team did everything right they could literally make it 100x more secure. But that still only brings it to 1 M$. That is completely and utterly insufficient to stop the financially-motivated professional organized crime that are actively attacking them. This is not about theoretical attacks and threat actors, these are the people literally attacking them right now that they can not stop, that cause the most damage, and that can perform these attacks economically at 1 M$. To use the Caesar Entertainment incident that happened just before as a example, they purportedly paid a 15 M$ ransom. Is raising the cost to attack them from 10 K$ to 1 M$ really going to stop someone from collecting the 15 M$ payday? Oh no, I will only make 14 M$ instead of 14.99 M$, no point in attacking them. No, that is ridiculous. Making it harder is not a solution, you need to make it unprofitable. If it is profitable you will eventually be hit by a incident and that incident can be unboundedly bad all the way up to completely destroying your business. In addition, your susceptibility is not random. A targeted attack will succeed and will be wildly profitable to perform no matter what you do. This is not a "I need to outrun you, not the bear" scenario. The bear is very hungry and can catch both of you; it will eat the fatter and tastier one, not the slower one. Then it will catch and eat the other one. Your only protection is being less tasty so you get eaten last. You need to make it unprofitable and no extant solution available today in commercial IT can make it unprofitable for financially-motivated professional attackers. "Best practices" are maybe 1-10% of the way to minimally adequate; we need solutions 10 to 100 times better than the current gold standard to get there. Yes, I said times, not percent. We need a 1,000% to 10,000% improvement to get to the minimum bar. Until then, buckle in since things are just getting started; we are in for some real wild times on this ride.
- red-iron-pine 3y ago
  Clorox had been hit once before and had high levels of turnover & outsourcing. Not surprised it happened again. Most of their infra was 100% outsourced to HCL / Tata / Cognizant / etc., or their Mexican / Filipino equivalents. You get what you pay for.
ses1984 3y ago
I wonder if they ever found a sysadmin willing to work around the clock for $100/hr.
- baq 3y ago
  Yeah that one was funny. $100/hr would probably cover only the interview rate for this particular job.
- baobabKoodaa 3y ago
  What is this referencing?
  - insanitybit 3y ago
    They put out a job posting basically saying "We need you to work 24/7 for a few months to rebuild our infra" and then offered $100/hr
    - henry2023 3y ago
      I now get why they got hacked.
  - Decabytes 3y ago
    They put out a job offer that was $100 an hour with you being on call 7 days a week
    - renegade-otter 3y ago
      I think the casino business is awash in so much money that they don't understand how it works in the real world. "$100 an hour sounds like enough on this planet, yeah? Let's go with that, a nice round one hundred an hour!"
      - kube-system 3y ago
        The job wasn't posted by MGM it was posted by a contractor.
btilly 3y ago
I happened to be in Vegas during this. It was weird. Parking at the MGM was free because they had no way to take credit cards. Rumor was that Caesars was hit by the same group, and paid the ransom. As a reminder, these attacks are overwhelmingly carried out by Russian gangs, and are only possible because of crypto. See https://www.lawfaremedia.org/article/ransomware-problem-bitcoin-problem https://www.lawfaremedia.org/article/ransomware-problem-bitc... for more.
- improv 3y ago
  >only possible because of crypto Marcus Hutchins: Why Destroying Bitcoin Wouldn't Stop Corporate Ransomware https://youtu.be/LDIGJRd_PyE?si=-TUIEnONm3_D8LzZ https://youtu.be/LDIGJRd_PyE?si=-TUIEnONm3_D8LzZ
  - 2OEH8eoCRo0 3y ago
    Who is this and why should I care what they think? It's a fact these criminals use crypto currencies. Why do they use them?
    - vsareto 3y ago
      He stopped WannaCry worldwide
      - jstarfish 3y ago
        He's got more hacker cred than that; he used to write banking trojans.
  - mminer237 3y ago
    That did not need to be a 12-minute video. I don't know if it would stop it, but without cryptocurrencies, it would certainly be much less. Laundering USD is significantly harder than laundering Bitcoin.
    - jandrese 3y ago
bannedbybros 3y ago
[dead]
insanitybit 3y ago
Crazy to think about what you can do with 100m in terms of security. You can start multiple companies around securing your infrastructure with 100m. It's insane.
lulznews 3y ago
Wild underestimate. Clearly >$1B.
- plasticsoprano 3y ago
  How do you figure? MGM did about $13 billion in revenue last year and while things certainly sucked they were still making money while things were down. Slots weren’t running but table games were up and gaming isn’t the majority share of where they make their money. Room fees make more. Food and beverages make more. Entertainment makes slightly less than gaming. 100 million isn’t out of the question.
JoshTko 3y ago
ITT, people who either own crypto or don't own crypto.
hunter2_ 3y ago
> "We have no evidence that the criminal actors have used this data to commit identity theft or account fraud." I see this type of message on so many statements about breaches. It seems like one of those things that can be said even when the potential usage in question would be extremely likely, because even if every marketplace for this stuff is advertising "identities stolen from MGM" for sale, that alone isn't "evidence" that it's actually what it says on the tin. If someone purchased it and showed their purchase to MGM, would that be sufficient "evidence" for them to not make such a statement?
hindsightbias 3y ago
Funny story, there was an IBM i (as/400) conference going on at the MGM. i runs a lot of casinos/hotels. But not MGM.
ella43 3y ago
[dead]

90 points by isaacfrond 3y ago

Another noteworthy newspiece of large loss caused by a cybersecurity incident came from Clorox*: > the incident had disrupted portions of the company's IT infrastructure... The company expects a loss per share of between 35 cents and 75 cents in the quarter ended on Sept. 30, and for net sales to fall by 23% to 28% from a year earlier. It had reported profit of 68 cents per share in the year-ago period. Still, you see CISOs fight tooth and nail to get a couple million approved for boosting cybersecurity posture. https://www.reuters.com/business/retail-consumer/clorox-expects-quarterly-loss-hit-cyberattack-2023-10-04/ https://www.reuters.com/business/retail-consumer/clorox-expe...

toomuchtodo 3y ago
The financial impact will continue until culture and budgets improve. The folks making these decisions are not sophisticated and competent in risk management. EDIT: @RugnirViking, my brother in christ, I agree with everything you said about culture.
- RugnirViking 3y ago
  > The folks making these decisions are not sophisticated and competent in risk management Aren't they pretty good at financial risk? isnt that like their only job a lot of the time? Idk it seems to me it must be possible to make a good argument for this stuff - How do cybersecurity consulting firms pitch to clients? Could McKinsey etc get in on it? It's just hard internally because a lot of the time it requires the culture to have been there from the beginning. Changing the culture if it's not present already is like trying turning a supertanker with a desk fan. People resent loss of freedoms, and operational restrictions prevent getting everyone to understand the whys
- dvh 3y ago
  No, it will not improve. They will be slowly replaced by companies with better security.
  - red-iron-pine 3y ago
    risk vs. reward. as long as they still control the bleach and misc. chemical market, it's just a cost of doing business.
- supportengineer 3y ago
  Perhaps SRE's would make the best CEO's
  - deleted 3y ago
    [deleted]
- wongarsu 3y ago
  "The company's shares fell 2% in extended trading after the outlook was released." That's a pretty mild impact. Multiply that with the low probability of this actually happening to a given company, and taking the risk doesn't sound sooo bad. Obviously it went wrong in this case, but it's hard to tell from the outside if that's because they did bad risk management or because they got unlucky on a calculated risk.
- cj 3y ago
  Is it a given that the loss isn’t covered by insurance? There’s always a balance of risk and the cost of mitigating risk. One way to mitigate risk is simply buying an insurance policy which in many cases may be cheaper than paying a security firm to protect yourself proactively. Cyber insurance often includes things like coverage for a PR firm to help regain as much reputational damage that may have been incurred. Many cyber insurance plans also includes coverage for paying ransoms. (I’m playing devils advocate somewhat, buying insurance to protect against cyber is something companies should do alongside of taking a proactive approach to securing systems)
  - toomuchtodo 3y ago
    I am responsible for negotiating a cyberinsurance policy for a fintech, and the marketplace is drying up due to risk repricing. If it was my money, I wouldn't be backstopping anyone getting underwritten unless I can plug directly into their controls and observability systems to confirm their risk posture, as well as have an internal (to the insurer) IR team. I'd probably also require quarterly IR tabletops and red teaming without prior notification required. Less around process and attestation, more about real world validation. https://news.bloomberglaw.com/insurance/as-cyber-insurance-dries-up-treasury-department-eyes-a-backstop https://news.bloomberglaw.com/insurance/as-cyber-insurance-d... (I have also provided comments to the US Treasury on backstopping cyberinsurance and perverse incentives around doing so)
    - cj 3y ago
      Typically when applying for cyber insurance you submit a questionnaire which includes questions like “do all endpoints us AV” and “Do you use IDS on your network” etc, etc. To a certain extent insurance shouldn’t need to verify controls if they’re able to have a company fill a questionnaire, and if their answers aren’t accurate the insurance carrier can use that as a basis for denying the claim. I would hope any federal program (if one comes about) works similarly. “We will only cover incidents if we can verify after the fact that you had these controls and mitigation measures in place prior to the attack”
      - 3y ago
Veserv 3y ago
As any competent security executive would tell you, even if they had a unlimited budget, complete management support, all recommendations followed, and total control over business process short of utterly crippling operations, the cost of hiring a hacker to completely breach the best possible form of their system would still be less than 1 M$. Oh, but what about the banks? Yeah, those are the security executives who personally told me and my colleagues that when asked. They literally have 100 M$ budgets up to 1 G$ budgets and they said that. The problem is not money, the problem is that commercial IT security technology and vendors do not work against professional, financially-motivated threat actors.
- wepple 3y ago
  I disagree. With sufficient buy-in and money, you can make your systems extremely difficult and costly to attack, making the economics of an attack not worth it. I’m willing to bet that a place like MGM has utterly abysmal security. You don’t see regular attacks against top-tier companies because a lot of them invest a reasonable amount.
- waihtis 3y ago
  You're not wrong, but reading the autopsies of most of these 100M dollar incidents suggest that having a slightly above average detection posture would eliminate most of the damage.
  - Veserv 3y ago
    Sure, in many of the post-mortems you can see that the attack probably only cost something like 10 K$ to execute. If their team did everything right they could literally make it 100x more secure. But that still only brings it to 1 M$. That is completely and utterly insufficient to stop the financially-motivated professional organized crime that are actively attacking them. This is not about theoretical attacks and threat actors, these are the people literally attacking them right now that they can not stop, that cause the most damage, and that can perform these attacks economically at 1 M$. To use the Caesar Entertainment incident that happened just before as a example, they purportedly paid a 15 M$ ransom. Is raising the cost to attack them from 10 K$ to 1 M$ really going to stop someone from collecting the 15 M$ payday? Oh no, I will only make 14 M$ instead of 14.99 M$, no point in attacking them. No, that is ridiculous. Making it harder is not a solution, you need to make it unprofitable. If it is profitable you will eventually be hit by a incident and that incident can be unboundedly bad all the way up to completely destroying your business. In addition, your susceptibility is not random. A targeted attack will succeed and will be wildly profitable to perform no matter what you do. This is not a "I need to outrun you, not the bear" scenario. The bear is very hungry and can catch both of you; it will eat the fatter and tastier one, not the slower one. Then it will catch and eat the other one. Your only protection is being less tasty so you get eaten last. You need to make it unprofitable and no extant solution available today in commercial IT can make it unprofitable for financially-motivated professional attackers. "Best practices" are maybe 1-10% of the way to minimally adequate; we need solutions 10 to 100 times better than the current gold standard to get there. Yes, I said times, not percent. We need a 1,000% to 10,000% improvement to get to the minimum bar. Until then, buckle in since things are just getting started; we are in for some real wild times on this ride.
red-iron-pine 3y ago
Clorox had been hit once before and had high levels of turnover & outsourcing. Not surprised it happened again. Most of their infra was 100% outsourced to HCL / Tata / Cognizant / etc., or their Mexican / Filipino equivalents. You get what you pay for.

ses1984 3y ago

I wonder if they ever found a sysadmin willing to work around the clock for $100/hr.

baq 3y ago
Yeah that one was funny. $100/hr would probably cover only the interview rate for this particular job.
baobabKoodaa 3y ago
What is this referencing?
- insanitybit 3y ago
  They put out a job posting basically saying "We need you to work 24/7 for a few months to rebuild our infra" and then offered $100/hr
  - henry2023 3y ago
    I now get why they got hacked.
- Decabytes 3y ago
  They put out a job offer that was $100 an hour with you being on call 7 days a week
  - renegade-otter 3y ago
    I think the casino business is awash in so much money that they don't understand how it works in the real world. "$100 an hour sounds like enough on this planet, yeah? Let's go with that, a nice round one hundred an hour!"
    - kube-system 3y ago
      The job wasn't posted by MGM it was posted by a contractor.

btilly 3y ago

I happened to be in Vegas during this. It was weird. Parking at the MGM was free because they had no way to take credit cards. Rumor was that Caesars was hit by the same group, and paid the ransom. As a reminder, these attacks are overwhelmingly carried out by Russian gangs, and are only possible because of crypto. See https://www.lawfaremedia.org/article/ransomware-problem-bitcoin-problem https://www.lawfaremedia.org/article/ransomware-problem-bitc... for more.

improv 3y ago
>only possible because of crypto Marcus Hutchins: Why Destroying Bitcoin Wouldn't Stop Corporate Ransomware https://youtu.be/LDIGJRd_PyE?si=-TUIEnONm3_D8LzZ https://youtu.be/LDIGJRd_PyE?si=-TUIEnONm3_D8LzZ
- 2OEH8eoCRo0 3y ago
  Who is this and why should I care what they think? It's a fact these criminals use crypto currencies. Why do they use them?
  - vsareto 3y ago
    He stopped WannaCry worldwide
    - jstarfish 3y ago
      He's got more hacker cred than that; he used to write banking trojans.
- mminer237 3y ago
  That did not need to be a 12-minute video. I don't know if it would stop it, but without cryptocurrencies, it would certainly be much less. Laundering USD is significantly harder than laundering Bitcoin.
  - jandrese 3y ago

bannedbybros 3y ago

[dead]

insanitybit 3y ago

Crazy to think about what you can do with 100m in terms of security. You can start multiple companies around securing your infrastructure with 100m. It's insane.

lulznews 3y ago

Wild underestimate. Clearly >$1B.

plasticsoprano 3y ago
How do you figure? MGM did about $13 billion in revenue last year and while things certainly sucked they were still making money while things were down. Slots weren’t running but table games were up and gaming isn’t the majority share of where they make their money. Room fees make more. Food and beverages make more. Entertainment makes slightly less than gaming. 100 million isn’t out of the question.

JoshTko 3y ago

ITT, people who either own crypto or don't own crypto.

hunter2_ 3y ago

> "We have no evidence that the criminal actors have used this data to commit identity theft or account fraud." I see this type of message on so many statements about breaches. It seems like one of those things that can be said even when the potential usage in question would be extremely likely, because even if every marketplace for this stuff is advertising "identities stolen from MGM" for sale, that alone isn't "evidence" that it's actually what it says on the tin. If someone purchased it and showed their purchase to MGM, would that be sufficient "evidence" for them to not make such a statement?

hindsightbias 3y ago

Funny story, there was an IBM i (as/400) conference going on at the MGM. i runs a lot of casinos/hotels. But not MGM.

ella43 3y ago

[dead]