“Cyber impact likely more modest than feared” read the headline on a J.P. Morgan investor note Friday morning. It came in reaction to a Securities & Exchange filing by MGM Resorts International that its cash flow had taken a $100 million hit from the Sept. 10 cyberattack on the company’s nerve center.
“However, cyber insurance will help recover losses and the casino giant is well positioned for a strong fourth quarter,” chronicled CDC Gaming Reports.
Wall Street analysts took solace from such news, although MGM’s operations are still not fully up and running, according to an official statement by MGM Resorts CEO Bill Hornbuckle.
Costs directly related to the attack (summarized by Morgan analyst Joseph Greff as “technology, consulting, legal, and other advisor costs”) were pegged at $10 million. According to analyst consensus, the entire $100 million hit will be covered by insurance, although the full scope of the cost to the company remains undetermined.
Deutsche Bank analyst Carlo Santarelli put the news in the context of MGM’s stock performance. Shares of MGM have declined 19 percent since Sept. 10, “broadly akin” to the share performance of MGM’s Las Vegas Strip rivals.
“Broadly, we believe the financial clarity around this issue, as well as the reaffirmation of a limited impact to 4Q23 trends, will serve as a positive for shares,” Santarelli concluded. He adjusted his revenue forecast for the third quarter from $765 million to $685 million and his cash-flow prediction from $299 million to $279 million.
The brunt of the financial wallop was borne by MGM’s Strip properties, to the tune of $80 million, with the remaining $20 million distributed among the company’s regional casinos. Hotel occupancy was driven down to 88 percent by the attack, “despite limited booking availability during the incident,” reported Greff.
He added that MGM was climbing back to 93 percent occupancy in October, a slight dip from 2022, and will reach 100 percent in November, propelled by the Las Vegas Grand Prix.
Greff’s relief was shared by Truist Securities analyst Barry Jonas. Looking at the effect on MGM in the wider context of overall Strip room bookings, he detected “some relative MGM underperformance.”
By contrast, Caesars Entertainment, which suffered its own late-August cyberattack, “has shown particularly strong [week-over-week] acceleration through October,” compared to relatively modest increases in MGM room rates. Jonas’s research also showed MGM room rates dipping five percent during the period of the attack, while those for Caesars properties remained steady.
Contrary to Greff, Jonas found that Formula One weekend room rates had “shown some deceleration.” (Grandstand tickets were also made available to Las Vegas locals for the first time this week at $200 a seat.)
“MGM stated it believed the cyberattack was fully contained, although noted that on September 29, MGM became aware that hackers had made off with some customer personal data on September 11,” Jonas reported. The company, he added, had managed to safeguard passwords, payment-card data, and bank-account numbers from the attackers.
Jonas thought it “possible” that Caesars might have captured hotel business from MGM, even though management said it was running “at very high occupancy levels.” Another beneficiary was Wynn Las Vegas, where sequential improvements in room rates followed the MGM assault.
Overall, high-end properties such as those owned by Wynn, Caesars, and MGM were described as “resilient,” with those run by MGM and Caesars up 90 percent from 2022 during Formula One weekend. Room rates were decelerating at certain lower-end properties, however. With reference to the Grand Prix, Jonas stated that rates were still lofty for mid-November, “which is historically one of the slowest Vegas weekends.”
