MGM Resorts Data Breach Exposes 24.8 M Guest Records Across Multiple Years
What Happened — A breach of a MGM Resorts cloud service, first discovered in 2019, resulted in the exposure of 24,842,001 guest records. The data set, later shared on Telegram and dark‑web marketplaces, contains names, email addresses, phone numbers, physical addresses, and dates of birth.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of cloud‑service misconfiguration that a continuous control‑assurance program is built to detect and remediate.
- Highlights the need for auditable evidence that configuration controls are consistently applied and monitored across all cloud assets.
- Shows how a documented, repeatable configuration‑management process can provide a defensible audit trail for regulators and partners.
Who Is Affected – Hospitality and resort operators that store guest personal data in cloud environments; any organization that relies on third‑party cloud services for customer information.
Recommended Actions – Conduct a comprehensive inventory of cloud workloads, validate configuration baselines against hardening guides, implement continuous monitoring with automated alerts, and collect evidence of compliance for audit readiness. Source: [Have I Been Pwned – MGM2022Update]
Technical Notes – The breach originated from a cloud‑service misconfiguration that allowed unauthorized access to a database containing 142 M rows of guest data. No specific CVE is cited; the exposure includes PII such as dates of birth, addresses, and phone numbers. Source: [Have I Been Pwned – MGM2022Update]