The Park MGM hotel and casino in Las Vegas, July 28, 2023.
Bridget Bennett | Bloomberg | Getty Images
MGM Resorts filed a report Wednesday with the U.S. Securities and Exchange Commission as some of the company’s critical systems remain shut down, three days after the company first acknowledged that a “cybersecurity issue” prompted it to take its networks offline.
MGM continued to describe the situation as a “cybersecurity issue” in its SEC filing.
The company has not yet brought its corporate email, restaurant reservation and hotel booking systems back online. Digital room keys remain offline. MGM’s website initially displayed a list of phone numbers for its properties across the U.S. but now advises patrons to access Live Nation’s Ticketmaster or AXS for event tickets.
Credit agency Moody’s warned on Wednesday that the cyber incident highlighted “key risks” within MGM and could negatively affect the company’s credit rating. A spokesperson for MGM declined to comment on the Moody’s warning.
MGM’s share price has declined more than 6% since Monday, the day it first acknowledged the outages, compared to a modest gain in the S&P 500 during the same period.
The FBI told CNBC on Monday it is monitoring the “ongoing” situation. The SEC’s new cyber disclosure rules will not go into effect until the end of the year, so MGM is not yet obligated to provide more information to the SEC than they already have.
On social media, patrons have expressed frustration with the scope and duration of the outage, with some describing how hotel key cards aren’t working. Others expressed concerns about the security of their personal data. In 2020, MGM acknowledged that it had lost the personal information of more than 10 million customers in a hack. The data resurfaced on a hacking forum that same year.
MGM is communicating with the press through noncorporate, commercially available email addresses. Other than a brief update Tuesday confirming that the company had brought its gaming floors back online, MGM has provided little further information.
The SEC did not immediately respond to CNBC’s request for comment.