MGM Resorts logo

MGM Resorts Cyberattack: A Harsh Reminder of the Importance of Cybersecurity Training

By Matthew Mangels – Director of Information Security & Compliance

 

The recent MGM Resorts ransomware attack didn’t rely on fancy hacking tools. Armed with basic information found on LinkedIn, the hackers bypassed MGM’s cybersecurity measures with a convincing story and an empathetic support personnel trying to help a “user.” 

According to a study by the World Economic Forum,95% of cybersecurity breaches result from human error. In this case, the human error enabled threat agents to execute a modern-day Trojan Horse. The hackers tricked the MGM support desk employee by using a tactic called social engineering, the act of deceiving or manipulating a person to grant access to a computer system or steal personal and financial information. The hackers disguised themselves as a user who forgot their password or needed their MFA authenticator reset to slip inside MGM’s security walls, and once they crossed the threshold, agents deployed ransomware to encrypt valuable data and halt their operations.  

This one misstep caused a 10-day computer shutdown. A report by AP News revealed that MGM Resorts lost hotel reservations and loyalty reward functions. In this time span, experts also estimate the hotel giant suffered a cumulative loss of $80 million dollars. 

While many write this off as a cautionary tale for enterprises with significant capital – it’s not. Tech.co reports that 82% of ransomware attacks target small-midsize businesses. 

82% of ransomware attacks target
small-midsize businesses.

When it comes to guarding online systems against attacks, a holistic approach is necessary for safeguarding valuable information. The data breach is a harsh reminder of the consequences of inadequate security training and how even the most advanced technical controls can be vulnerable. Use this reminder to ensure, in addition to good technical security controls, that the following is in place: 

  1. Employee Training and Awareness Program – Regularly educate employees about social engineering tactics like phishing, pretexting, and baiting.
  2. Strong Security Policy and Procedure – Develop a protocol for verifying the identity of individuals requesting sensitive information, especially if the request is unusual or unexpected.
  3. Access Control and Principal of Least Privilege – Ensure that employees have access only to the information and systems necessary for their roles and restrict individuals’ access rights to the minimum required for performing their job tasks. 

It’s easy to feel overwhelmed, however, you don’t have to tackle these issues alone. Guard your organization against hackers with the proper fortifications and training with Moonshot Solutions. We offer a FREE security and maturity assessment and evaluations of online defenses to cybersecurity. Let’s work together to become more resilient to social engineering attacks.  

Call Moonshot Solutions at 913-348-4582 to set up your free assessment or email us at info@moonshot-solutions.com. Stay safe out there! 

More
articles

Understanding the Top Cyberattacks in 2024

The consequences of a lack of education on cyberattacks are becoming increasingly prevalent for businesses, causing harmful effects to their reputation, financial stability and daily operations. As Truesec broadcasts for 2024, cyberattacks are only going to grow in frequency and effectiveness with the help of automation and AI.

Read More »

Securing Top Talent: 6 Ways Staffing Agencies Elevate Your Recruitment Game

The current labor shortage in the U.S. has businesses competing for qualified candidates. With more open jobs than people to fill them, the stakes are high to get applicants to notice your business. The recruitment process quickly changes from businesses casually posting on LinkedIn to head coaches pitching their organization to top recruits, with monologues on company culture, competitive pay and benefits, and work-life balance.

Read More »