Breach of MGM Hotels' Cloud Server Exposed Data on 10.6 Million People (zdnet.com) 15
Personal information from more than 10.6 million people was published online this week, reports ZDNet -- all from people who'd stayed at MGM Resorts hotels (which include the Bellagio, Mandalay Bay, and ARIA):
Besides details for regular tourists and travelers, included in the leaked files are also personal and contact details for celebrities, tech CEOs, reporters, government officials, and employees at some of the world's largest tech companies. ZDNet verified the authenticity of the data today, together with a security researcher from Under the Breach, a soon-to-be-launched data breach monitoring service. A spokesperson for MGM Resorts confirmed the incident via email.
According to our analysis, the MGM data dump that was shared today contains personal details for 10,683,188 former hotel guests. Included in the leaked files are personal details such as full names, home addresses, phone numbers, emails, and dates of birth... These users now face a higher risk of receiving spear-phishing emails, and being SIM swapped, Under the Breach told ZDNet.
Twitter CEO Jack Dorsey, pop star Justin Bieber, and DHS and TSA officials are some of the big names Under the Breach spotted in the leaked files.
While the data appears to be several years old, Irina Nesterovsky, Head of Research at threat intel firm KELA, tells ZDNet that the data has been shared in "hacking forums" since last July. MGM blames the breach on "unauthorized access to a cloud server" last summer -- pointing out that at least no credit card information was stolen, and that they notified all affected customers.
But NBC News "spoke to a man with a Secret Service email address who was surprised to learn that he had been hacked. He said MGM never notified him about to breach."
MGM told ZDNet that "we take our responsibility to protect guest data very seriously, and we have strengthened and enhanced the security of our network to prevent this from happening again."
According to our analysis, the MGM data dump that was shared today contains personal details for 10,683,188 former hotel guests. Included in the leaked files are personal details such as full names, home addresses, phone numbers, emails, and dates of birth... These users now face a higher risk of receiving spear-phishing emails, and being SIM swapped, Under the Breach told ZDNet.
Twitter CEO Jack Dorsey, pop star Justin Bieber, and DHS and TSA officials are some of the big names Under the Breach spotted in the leaked files.
While the data appears to be several years old, Irina Nesterovsky, Head of Research at threat intel firm KELA, tells ZDNet that the data has been shared in "hacking forums" since last July. MGM blames the breach on "unauthorized access to a cloud server" last summer -- pointing out that at least no credit card information was stolen, and that they notified all affected customers.
But NBC News "spoke to a man with a Secret Service email address who was surprised to learn that he had been hacked. He said MGM never notified him about to breach."
MGM told ZDNet that "we take our responsibility to protect guest data very seriously, and we have strengthened and enhanced the security of our network to prevent this from happening again."
What happens in Vegas ... (Score:2)
...stays on the Internet forever!
Re: Oh no, not again! (Score:1)
Comment removed (Score:4, Insightful)
Re: (Score:2)
My guess the best way is not to collect it at all.
Re: (Score:2)
My guess the best way is not to collect it at all.
Hotels are legally required to collect name, address, and ID information.
Hotels collect payment information because the rooms are not free.
Foreign Intelligence (Score:2)
Other hotel and hospitality hacks have been orchestrated by foreign intelligence services to track our intelligence operatives. I guess if you're using business emails to register for hotels, then you're just making it easy for the "bad guys" to track and target you. Similarly, CCleaner was hacked by the Chinese so malware targeting government and tech email domains can be pushed onto their systems.
https://www.cnn.com/2018/12/12... [cnn.com]
Security... (Score:2)
Are we supposed to be taking this seriously yet? I keep forgetting...
Nobody takes security seriously (Score:2)
As long as companies are able to just sweep stuff like this under the rug and get a payout from their "cyber insurance" policies, absolutely no company is going to take security seriously. If their only penalty is giving out free credit monitoring, there's zero incentive to improve.
Every company I've ever worked with or done business with has this same lax attitude. If their competitors aren't doing anything, then they feel there's no reason for them to either. This goes for banks, retailers, credit card co
Excuse? (Score:1)