MGM hack exposes personal data of 10.6 million guests

MGM has resorts across the US, including in Las Vegas

The personal information of 10.6 million guests who stayed at MGM Resorts hotels was hacked last summer.

The hack was first reported by ZDNet on Wednesday, which said the stolen information was posted to a hacking forum this week. MGM confirmed the attack took place to the BBC.

The data exposed included names, address, and passport numbers for former guests.

MGM said it was "confident" no financial information had been exposed.

The resort chain said it was unable to say exactly how many people were impacted because information that was exposed might be duplicated.

"Last summer, we discovered unauthorized access to a cloud server that contained a limited amount of information for certain previous guests of MGM Resorts. We are confident that no financial, payment card or password data was involved in this matter," a spokesperson for MGM Resorts said.

Among the people who were impacted included celebrities like Justin Bieber and Twitter founder Jack Dorsey. ZDNet reported. MGM would not confirm this.

'Phonebook information'

MGM said most of the data that was stole was "phonebook information" like names, telephone numbers and email addresses, which are already publicly available.

But approximately 1,300 former guests were notified that more sensitive information including passport numbers had been revealed.

A further 52,000 customers were told that less sensitive personal information was exposed. This was only a portion of those impacted.

MGM said its notification to customers followed state laws. Most US states do not require companies to tell customers if data which is already public has been exposed during a hack.

MGM has resorts in Las Vegas, Atlantic City and Detroit in the US. It also has property in China and Japan and is developing a new resort in Dubai.

According to ZDNet the data was posted to a hacking forum. Cyber attackers can use all sorts of information, even data that is less sensitive, to target an individual online.

This is not the largest hacking of hotel guest information. In 2017, Marriott Hotels experienced a much larger data breach exposing 500 million guests. That attack was linked to Chinese state-sponsored hackers.