MGM Resorts Exposes 3.08 M Guest Records in Cloud Service Breach
What Happened — In July 2019 MGM Resorts discovered that a cloud‑hosted guest‑profile service had been compromised, leaking 10.6 M records (3.1 M unique email addresses) dating back to 2017. The exposed data included names, email addresses, phone numbers, physical addresses and dates of birth, and was later posted on a public hacking forum in February 2020.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient oversight of third‑party cloud providers – a core control area that continuous‑monitoring programs are built to address.
- Highlights the need for auditable evidence that data‑handling policies (encryption, least‑privilege access, regular vendor assessments) are enforced across all outsourced services.
- Provides a real‑world example of why a documented incident‑response and breach‑notification process is essential for defensible audit trails.
Who Is Affected – Hospitality operators, resort chains, and any organization that outsources guest‑profile data to cloud platforms.
Recommended Actions
- Initiate a third‑party risk review of all cloud services handling personal data.
- Verify that contracts include security‑by‑design clauses, encryption‑at‑rest, and right‑to‑audit provisions.
- Deploy continuous monitoring tools to detect anomalous access or data‑exfiltration events.
- Update incident‑response playbooks to include rapid notification and forensic collection for cloud‑based breaches.
Source: Have I Been Pwned – MGM Resorts breach
Technical Notes
- Attack vector: Misconfiguration / inadequate access controls in a cloud‑hosted guest‑profile service.
- No public CVE; the breach stems from a cloud provider’s security gap rather than a software flaw.
- Data types exposed: personally identifiable information (PII) – name, email, phone, address, date of birth.
Source: same as above