In September 2023, two major casino companies, Caesars Entertainment and MGM Resorts, faced cyberattacks within days of each other. Caesars reportedly paid approximately $15 million of a $30 million ransom demand to maintain operations, while MGM Resorts reportedly refused, resulting in a 10-day shutdown and an estimated $100 million financial impact, according to company statements and media reports. These differing approaches highlight the critical role of communication strategies in crisis management.
Published October 2026.
Few crisis communications comparisons are as clear as the one presented by the casino industry in September 2023. Two large operators, Caesars Entertainment and MGM Resorts, faced attacks from the same reported group and made opposite decisions. This analysis examines the public record to provide insights for casino communications teams.
What happened during the Caesars and MGM cyberattacks in September 2023?
In September 2023, two major casino operators were attacked by the same group, reportedly choosing opposite responses to a ransom demand. Caesars disclosed a cyberattack dated September 7, 2023, reporting that its casino and online operations remained undisrupted, according to the Associated Press. CNBC reported, citing sources familiar with the matter, that attackers demanded $30 million, and Caesars agreed to pay approximately half, with cyber insurance partially offsetting the cost.
MGM's incident was more public. The company detected its cyberattack on September 10, 2023. It responded by shutting down some casino and hotel computer systems at properties nationwide to protect data. Guests reported difficulties using credit cards, withdrawing cash, and accessing hotel rooms. The Associated Press stated that MGM announced the end of its 10-day computer shutdown on September 20, 2023.
The reported group behind both attacks was Scattered Spider, a subgroup linked to the ALPHV ransomware gang. Google's Mandiant told CNBC that many members are native English speakers and highly effective social engineers. This detail is significant for communications teams because it suggests human vulnerability, rather than software flaws, was the entry point. Communications teams can brief staff on social engineering tactics.
Why did Caesars avoid a public outage while MGM experienced one?
Caesars avoided a public outage because its reported ransom payment allowed operations to continue without visible symptoms. An operational disruption is immediately apparent to every guest. Caesars filed its SEC report on September 14, 2023, after MGM's systems had already gone dark. CNBC noted at the time that the reason for the filing delay was unclear. The filing stated Caesars did not expect a material financial effect, but it did not confirm a payment. Reporters relied on anonymous sources for payment details.
MGM had no such option. Slot machines, reservation systems, and room keys failed directly in front of customers. Guests with phones in hand shared their experiences on social media before MGM could release an official statement. The company used its own channels to post updates. Eight days after initially disclosing the attack, MGM posted on X that resort services, dining, entertainment, and gaming floors were operating normally, as reported by The Nevada Independent.
This asymmetry shows that companies able to conceal problems may be tempted to do so. Companies unable to conceal problems are forced to communicate publicly. The latter typically builds more trust, even if short-term financial impacts appear worse, because the public observes how the company behaves under pressure.
What were the costs beyond immediate financial impact for each company?
Each company's decision incurred costs not immediately reflected in initial financial statements. MGM informed the SEC on October 5, 2023, that the attack would reduce adjusted property earnings by approximately $100 million across its Las Vegas and regional businesses. Additionally, less than $10 million in one-time charges were anticipated for legal and technology assistance. A UNLV cybersecurity professor, quoted by the Associated Press, cited estimates of up to $8 million per day for the shutdown, illustrating how quickly an outage compounds in a 24/7 business.
MGM also experienced significant data loss. CEO Bill Hornbuckle informed customers that hackers accessed names, contact details, driver's license numbers, Social Security numbers, and passport numbers belonging to some individuals who transacted with MGM before March 2019. He clarified that bank account and payment card information was not compromised. Hornbuckle included an apology to affected customers in his letter.
Caesars paid a different type of cost. Its SEC filing stated the company took steps to ensure stolen data was deleted by the attacker, though it noted it could not guarantee this outcome. In essence, the payment secured a promise, not certainty. The Nevada Independent reported that the stolen data was associated with the company's customer loyalty program. Associated Press coverage described Caesars as having over 65 million rewards members.
Both companies faced legal repercussions. The Las Vegas Review-Journal reported that within weeks of the attacks, Caesars and MGM collectively faced nine federal lawsuits.
Did MGM definitively refuse to pay the ransom?
MGM is reported to have refused the ransom, but the company has not officially confirmed this. The Wall Street Journal reported, citing a person familiar with the matter, that MGM declined to pay the hackers' demand. According to the Associated Press, an MGM spokesman neither confirmed nor denied this report. When discussing these events, communications teams should clarify that the contrast in ransom payment is based on reported information, not verified company statements.
The reported contrast remains instructive. One company paid and remained operational, while the other did not pay, endured a 10-day outage, and absorbed an estimated $100 million financial hit. Security experts disagree on the optimal choice. The FBI discourages ransom payments. The Associated Press cited Norsk Hydro, which lost approximately $70 million in 2019 after refusing to pay. Alternatively, MGM's customers effectively bore the cost of the company's principled stance, which presents a significant communications challenge in addition to a security one.
Which company managed their crisis more effectively?
Neither Caesars nor MGM handled their crisis flawlessly. A more useful approach is to examine what each company did well. MGM demonstrated strengths in transparency and customer outreach. The company communicated during its outage, published a clear restoration message, and its CEO issued a written apology to customers whose data was compromised. MGM's weakness was that the public learned the full extent of the problem from guests' social media posts before the company provided an official narrative.
Caesars' primary strength was containment, as its casino floors remained open. Its weaknesses were timing and tone. The company disclosed the incident late, did not confirm media reports, and allowed the narrative to be shaped by anonymous sources and its competitor's more public ordeal. When facts reach the public through leaks, the company loses control of its own crisis narrative.
The critical standard is not whether to pay a ransom, but whether the decision was made proactively, on principle, and if the company is prepared to explain it. Both companies were forced to make decisions within hours. Neither had the luxury of crafting their message after the fact.
What should a casino communications team prepare before a cyberattack?
A casino communications team should have six essential items drafted and approved before a cyberattack occurs. The first 72 hours of a crisis leave no time for drafting. This list is recommended for any casino or sportsbook executive team:
- Holding statements for three scenarios: Prepare pre-approved language for a confirmed outage, a confirmed data theft, and a ransom demand, with legal counsel's approval.
- A guest plan for manual operations: Establish protocols for staff to inform hotel and casino guests when digital systems fail, including credit card processing, cash machines, and room keys. Designate personnel to communicate this information in person.
- A regulator contact list: Compile a list of gaming commissions and attorneys general for every state of operation. Define who will contact them and the sequence of communication.
- A disclosure clock: A new SEC rule, effective by late 2023, requires prompt public disclosure of material cyber incidents. A public company's board needs a written process guiding detection to filing.
- A ransom decision protocol: The CEO, board, legal counsel, insurer, and communications lead should agree in advance on who decides on ransom payments, the decision-making criteria, and the company's communication strategy for each outcome.
- A loyalty-data message: Prepare a pre-drafted notice for rewards members, including identity protection offers, to ensure the initial message is not improvised.
A broader guide for the first 72 hours is available in the cyberattack crisis PR playbook. These scenario drafts should be integrated into a crisis communication plan that the executive team has rehearsed. Additional case studies are available in the crisis communications hub.
Why are cyberattacks particularly critical for the casino industry?
Cyberattacks are more critical for casinos than for other industries due to their reliance on gaming licenses and their extensive customer databases. A gaming license depends on regulatory trust. Casinos manage some of the largest customer databases in consumer business. While a retailer suffering a breach risks losing customer trust, a casino facing a breach also confronts regulators who determine its operational license in a given state. This dual audience, public and regulatory, is a recurring theme in casino public relations, connecting regulation, crisis, and trust.
This dynamic also shapes the gambling public relations guide for casinos and sportsbooks. Operators who treat communications as a legal afterthought discover during a crisis that they lack established relationships when they are most needed. Operators who cultivate these relationships proactively benefit from the "benefit of the doubt," which is invaluable during a crisis.
What is the lasting lesson from the Caesars and MGM cyberattacks?
The lasting lesson is that a crisis decision is inherently a communications decision and should be treated as such from the outset. The contrast between Caesars and MGM will be studied for years because it isolates key variables: same attackers, same month, same industry, but different strategic choices. Decisions regarding payment, disclosure timing, guest communication, and regulator engagement all become part of the public record.
A smaller, yet valuable, point emerges from this story: neither company controlled the initial headline. In both instances, external parties framed the events before the companies did. A well-prepared company can significantly reduce this gap. An unprepared company will spend weeks trying to catch up to a narrative already established by others.
Frequently Asked Questions About the Casino Cyberattacks
Did Caesars pay the ransom?
Sources told CNBC that Caesars paid approximately $15 million of a $30 million demand. The company's SEC filing did not confirm a payment, so this figure remains a report, not an official disclosure.
Did MGM pay the ransom?
The Wall Street Journal reported that MGM refused to pay the ransom. An MGM spokesman, according to the Associated Press, neither confirmed nor denied this report.
What was the estimated cost of the MGM cyberattack?
MGM informed the SEC it anticipated an estimated $100 million reduction in adjusted property earnings. Additionally, it expected less than $10 million in one-time charges for legal and technology consulting services.
How long were MGM's systems affected by the cyberattack?
MGM detected the incident on September 10, 2023, and announced the end of its 10-day computer shutdown on September 20, 2023.
Who was responsible for the cyberattacks on Caesars and MGM?
Reporting linked both attacks to Scattered Spider, also tracked by Mandiant as UNC3944. Security researchers have connected this group to attacks on other large companies.
Sources: CNBC reported on the Caesars ransom, and the Associated Press reported on MGM's estimated $100 million impact. Figures attributed to anonymous sources are reported, not confirmed by the companies.
Ronn Torossian is a communications executive and the author of "For Immediate Release."