Researchers discovered that the personal information of about 10.6 million people who had visited hotels MGM Resorts was published this week on a hacking forum.
Among the guests and tourists who stayed at these hotels were celebrities, tech CEOs, journalists, government officials, and employees at some of the companies world's. This means that the personal data and contact information of all of these people are exposed.
A spokesperson for MGM Resorts confirmed the incident via email.
What kind of data is exposed on the hacking forum?
According to the available data, the exposed MGM Resorts hotel database contains personal information for 10,683,188 former hotel guests.
The exposed data includes: full names, home addresses, phone numbers, emails and dates of birth.
Prominent journalists, CEOs and government officials, whose details are on the hacking forum, confirmed that they had been to the Las Vegas hotel.
MGM Resorts says it has notified customers about the leak
The MGM Resorts hotel security team confirmed the leak and linked it to a security that took place last year.
"Last summer we discovered unauthorized access to a cloud server that contained a limited amount of information about certain past MGM Resorts guests," the hotel said.
"We are confident that no payment details or passwords have been leaked.".
The hotel chain said it immediately notified all people who had visited the hotel.
Some users have posted online the notification they received in August last year .
Additionally, MGM Resorts said it has assigned two security firms to conduct an investigation into the server breach incident.
"At MGM Resorts, we take responsibility for protecting our guests' data and have strengthened security to ensure this never happens again," the company said.
Risk of spear-phishing and SIM swapping attacks
Posting personal data on a popular hacking forum cannot go unnoticed by hackers.
The leaked data includes personal information and contact details of very important people (from major tech companies and governments). This data can be used to carry out spear-phishing or SIM swapping attacks targeting these users.
Twitter CEO Jack Dorsey, pop star Justin Bieber and some DHS and TSA employees are some of the "big names" who visited MGM Resorts and found themselves on the hacking forum.
MGM Resorts said the data was old (pre-2017). Some of the phone numbers in the exposed data were no longer working, but many were still valid.
The size and severity of the security incident at the hotel chain can be compared to the data leak at Marriott hotels in 2017, when the details of millions of users were compromised by Chinese hackers.
