MGM Resorts' September 2023 cyberattack cost the casino and hotel operator $100 million in lost business, according to a regulatory filing the company made with the Securities and Exchange Commission in October 2023. That single disclosed figure anchors a pattern that runs across the hotel and travel sector: Marriott, Caesars, IHG, and a growing list of airlines have all disclosed costly breaches since 2018, and the group behind the MGM attack has since moved on to targeting airlines directly.
Below is what each of those disclosed incidents cost, how many guests each one exposed, and why the same attack group keeps showing up across hotels, casinos, and now airlines.
How much did the MGM Resorts breach cost?
MGM Resorts disclosed in its October 6, 2023 SEC filing that the September 2023 cyberattack, carried out by the Scattered Spider group using a ten-minute social engineering phone call to MGM's IT help desk, cost the company roughly $100 million, mostly from ten days of lost casino and hotel revenue while slot machines, reservation systems, and card terminals were down. MGM spent under $10 million more on outside consulting, legal fees, and other response costs, and the company noted the figures were not final as investigation continued.
That was not MGM's first disclosed breach. A separate 2019 incident exposed personal information for roughly 10.6 million guests, including celebrities and business leaders. The two incidents were later combined into a single class-action settlement: MGM agreed to pay $45 million to resolve more than a dozen lawsuits covering both breaches, a deal covering over 37 million customers that a Nevada federal court granted final approval on June 18, 2025, with claim payments distributed starting in December 2025.
Figure 1: Disclosed dollar figures from five hotel and travel sector breaches, in millions of US dollars: MGM Resorts' 2023 operating cost, Marriott's FTC settlement, MGM's separate class-action deal, Caesars' ransom payment, and Sabre's state settlement. Source: SEC filings, FTC press releases, and state attorney general settlements, as cited below.
If your business collects guest passport numbers, loyalty program details, or payment data of the kind exposed in these breaches, you can generate a privacy policy that documents the legal basis, retention periods, and breach-notification commitments guests and regulators expect to see.
How many people were affected by the Marriott and Starwood breaches?
Marriott and its Starwood subsidiary, acquired in 2016, disclosed three separate breaches between 2014 and 2020 that together exposed 344 million people worldwide, according to the FTC's October 2024 complaint. The largest began around July 2014 and went undetected until September 2018, when investigators found that attackers had accessed 339 million Starwood guest account records, including 5.25 million unencrypted passport numbers. A third, smaller breach, undetected from 2018 to February 2020, exposed 5.2 million guest records through a compromised franchise employee's credentials.
On October 9, 2024, the FTC and a coalition of 50 state attorneys general announced settlements requiring Marriott to pay $52 million and to undergo independent cybersecurity assessments for 20 years. The FTC's investigation found that Marriott and Starwood had failed to implement basic password, access, and firewall controls, had not patched outdated software, and did not adequately log network activity or deploy multi-factor authentication.
Figure 2: How Marriott's combined 344-million-person breach total splits between its two largest disclosed incidents. Source: FTC complaint, October 2024.
Much of Marriott's exposure traces back to a franchise model that many hotel brands share: a chain's name covers thousands of independently owned properties, and a single credential compromise at one franchised location can cascade into the parent company's central reservation systems. That same structural risk applies well beyond the big chains, and it is one reason small business owners who operate under a franchise brand carry the same breach-notification duties as the multinational company whose logo is on the sign.
Did Caesars Entertainment pay a ransom after its 2023 breach?
Yes. Caesars Entertainment disclosed that attackers, believed to be the Scattered Spider group, compromised a third-party IT support vendor around August 18, 2023, then accessed and stole Caesars' loyalty program database. Caesars discovered the breach on September 7, 2023, and confirmed it had paid attackers $15 million, about half of the $30 million originally demanded. The stolen database covered Caesars Rewards, a loyalty program with 65 million members, though Caesars has not disclosed a precise count of how many were affected, describing it only as a "significant number." Exposed data included names, addresses, phone numbers, dates of birth, driver's license numbers, and Social Security numbers.
Figure 3: The compliance path a hotel or casino follows after a suspected card-data or guest-data breach. Source: PCI Security Standards Council PCI DSS 4.0.1 summary, state breach notification law surveys.
Caesars' breach happened two weeks before MGM's, and security researchers have tied both intrusions to the same Scattered Spider group using nearly identical social engineering tactics against IT help desks and vendor support staff.
Are airlines facing the same cyberattacks as hotels?
Yes, and the timing suggests the same group is behind it. Scattered Spider, the group the FBI has linked to the 2023 MGM Resorts and Caesars breaches, shifted its focus to airlines in mid-2025. WestJet reported a cybersecurity incident beginning June 13, 2025, affecting internal systems and customer access to its app and website. Hawaiian Airlines disclosed a separate incident that began June 23, 2025. On June 30, 2025, Qantas detected unusual activity on a third-party platform used by its contact center. The FBI issued a warning on June 27, 2025, flagging Scattered Spider's expansion into the airline and transportation sector, days before the Qantas incident became public.
Figure 4: Landmark hotel and travel sector breaches by year. Source: SEC filings, FTC records, CSOonline, and company breach disclosures, as cited below.
In each airline case, the attack pattern echoed what happened at MGM and Caesars: rather than breaching an airline's core systems directly, attackers appear to have compromised third-party customer service platforms, of the kind used by call centers and help desks, through social engineering rather than a technical exploit.
How exposed are hotel booking systems and loyalty programs?
Two more incidents show that the risk sits in shared infrastructure and loyalty programs, not just at individual properties. Between August 2016 and March 2017, attackers accessed the Sabre Hospitality Solutions SynXis Central Reservation system, a booking platform serving more than 32,000 hotels and other lodging properties, exposing roughly 1.3 million payment cards from hotels including Trump Hotels, Four Seasons, and Loews Hotels. Sabre paid $2.4 million and agreed to strengthen its cybersecurity policies under a 2019 settlement with 27 state attorneys general.
In September 2022, IHG's booking systems went down for days after a pair of hackers calling themselves TeaPea gained access using the weak password "Qwerty1234." The hackers told the BBC they had originally planned a ransomware attack, but switched to a data-wiping attack after IHG's IT team began isolating servers. More recently, hotel management firm Pyramid Global Hospitality disclosed a ransomware breach from the WorldLeaks group that occurred August 13 to 14, 2025. The company's initial estimate of 52,100 affected individuals, reported in October 2025, was revised upward to more than 139,000 people by the time of its February 2026 disclosure, exposing names, Social Security numbers, passport numbers, driver's license numbers, and financial account data.
Loyalty programs carry a separate, less visible risk: account takeover. Industry estimates from hospitality security vendors, whose methodology is not always fully disclosed, put loyalty program fraud losses at more than $1 billion a year across large travel and hospitality companies, with roughly half of loyalty fraud incidents stemming from account takeovers rather than newly created fake accounts. A large share of loyalty accounts sit dormant between stays, which is exactly the kind of account a fraudster can take over and drain without the owner noticing for months.
How does hospitality compare to other breached industries?
The Identity Theft Resource Center tracked a record 3,322 total US data compromises in 2025, according to its Annual Data Breach Report published January 29, 2026, up 5% from 2024's 3,152 and a 79% jump over five years. Unlike financial services, which topped ITRC's rankings with 739 compromises and is the single most-breached US industry tracked, hospitality and travel are not broken out as one of ITRC's named top-line industry categories, which is one reason this page anchors its numbers in named, disclosed incidents rather than a single sector-wide count.
Figure 5: Total US data compromises tracked by the Identity Theft Resource Center, 2023 to 2025. Source: Identity Theft Resource Center Annual Data Breach Reports, 2023 through 2026 editions.
IBM's Cost of a Data Breach Report puts the global average breach cost at a record $4.99 million in 2026, with healthcare the costliest industry at $6.64 million and financial services second at $6.29 million, based on IBM's per-industry breach cost data. IBM's 2026 report does not publish hospitality or travel as a standalone named category in its top-line industry figures the way it does for healthcare and financial services, which is why the disclosed, named-incident costs above, MGM's $100 million and Marriott's $52 million among them, are the most reliable way to size what a breach actually costs a hotel or travel company today.
| Incident | Year | People or Records Affected | Disclosed Outcome |
|---|---|---|---|
| Sabre SynXis reservation breach | 2016-2017 | About 1.3 million payment cards, 32,000+ hotels | $2.4 million settlement with 27 states |
| Marriott and Starwood (three breaches) | 2014-2020 | 344 million people combined | $52 million FTC and state settlement (Oct 2024) |
| MGM Resorts | 2019 | 10.6 million guests | Included in $45 million class settlement |
| IHG booking systems | 2022 | Booking systems disrupted for days | No fine disclosed; data-wiping attack |
| MGM Resorts | 2023 | Not disclosed by exact headcount | $100 million business cost, plus $45 million class settlement |
| Caesars Entertainment | 2023 | "Significant number" of 65 million loyalty members | $15 million ransom paid |
| Scattered Spider airline attacks | 2025 | WestJet, Hawaiian Airlines, Qantas | FBI warning issued; scope still under review |
| Pyramid Global Hospitality | 2025 | 139,000+ individuals, revised from 52,100 | Disclosed February 2026 |
The Bottom Line
The hotel and travel sector's breach history is not a story about one bad year. It spans a decade of incidents, from Sabre's 2016 reservation-system breach through Marriott's three-part Starwood saga to the 2023 MGM and Caesars attacks and the 2025 shift toward airlines, and the dollar figures that companies have actually disclosed, MGM's $100 million, Marriott's $52 million settlement, Caesars' $15 million ransom, are large enough that no property, chain, or booking platform can treat this as a low-priority risk. The common thread across nearly every incident here is not a sophisticated technical exploit; it is a weak password, a social-engineered help desk call, or a compromised third-party vendor. Any hotel, casino, or travel company handling guest passport numbers, payment cards, or loyalty program data needs breach-notification language and a documented data-handling policy that reflect that reality, not a generic template written for a different kind of business.
Frequently Asked Questions
How much did the MGM Resorts breach cost? About $100 million in lost business, according to MGM Resorts' October 2023 filing with the Securities and Exchange Commission, plus under $10 million in consulting and legal fees. MGM separately paid $45 million to settle class-action lawsuits covering both its 2019 and 2023 breaches, a deal a Nevada federal court granted final approval on June 18, 2025.
How many people were affected by the Marriott and Starwood breaches? About 344 million people combined across three breaches between 2014 and 2020, according to the FTC's October 2024 complaint. The largest, discovered in 2018, exposed 339 million Starwood guest records including 5.25 million unencrypted passport numbers.
Did Caesars Entertainment pay a ransom after its 2023 breach? Yes. Caesars Entertainment paid attackers $15 million, about half of the $30 million originally demanded, after they stole its loyalty program database in August 2023. The database covered Caesars Rewards' 65 million members, though the company has not disclosed exactly how many were affected.
Are airlines facing the same cyberattacks as hotels? Yes. The Scattered Spider group, which the FBI has linked to the 2023 MGM Resorts and Caesars breaches, hit WestJet, Hawaiian Airlines, and Qantas within a three-week span in June 2025, prompting an FBI warning about the group's expansion into aviation and transportation.
Where the Numbers Come From
- The Record from Recorded Future News. (2023). "MGM Resorts says cyberattack cost $100 million, resulted in theft of customer info." October 6, 2023 SEC filing disclosure.
- Morgan & Morgan. (2025). "$45 Million Class Action Settlement Approved in MGM Resorts Data Breach Case." Final approval granted June 18, 2025, covering the 2019 and 2023 breaches.
- BleepingComputer. (2023). "Caesars Entertainment confirms ransom payment, customer data theft." $15 million ransom, September 2023.
- Federal Trade Commission. (2024). "FTC Takes Action Against Marriott and Starwood Over Multiple Data Breaches." October 9, 2024. $52 million settlement, 344 million people affected across three breaches.
- The Register. (2022). "InterContinental Hotels hit by cyberattack." September 6, 2022.
- BleepingComputer. (2022). "InterContinental Hotels Group cyberattack disrupts booking systems." September 2022.
- CSO Online. (2025). "Scattered Spider shifts focus to airlines as strikes hit Hawaiian, WestJet, and now Qantas." FBI warning issued June 27, 2025.
- CyberScoop. "Travel-booking company Sabre Corp. settles with 27 states over breach of credit card data." $2.4 million settlement, 1.3 million cards exposed.
- teiss. (2026). "Pyramid Global Hospitality data breach impacted close to 140,000 individuals." Revised count following the original October 2025 estimate of 52,100.
- Identity Theft Resource Center. (2026). "2025 Annual Data Breach Report: Record Number of Data Compromises in 2025." Published January 29, 2026. 3,322 total US compromises.
- IBM Newsroom. (2026). "IBM Study: One in Four Malicious Breaches are AI-Enabled." Cost of a Data Breach Report 2026, published July 29, 2026. Global average $4.99 million; healthcare $6.64 million; financial services $6.29 million.
Note: All figures verified as of August 2026. The Pyramid Global Hospitality individual-count figure has already been revised upward once, from roughly 52,100 to more than 139,000, and the exact number of Caesars Rewards members affected has never been disclosed by the company; treat both as subject to further clarification. Loyalty program fraud figures come from hospitality security vendors whose full methodology is not publicly disclosed and should be read as industry estimates, not audited totals. This post's figures are refreshed at least twice a year to track new ITRC and IBM report editions and any newly disclosed incidents.
