HackingTechnologyHospitalityInformationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Health (basic)LowContained

MGM Resorts International

bd_73b72419e0e127c4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 15, 2022

Filed

Jan 31, 2023

To disclose

7 weeks

Affected

3state residents only

Confidence

65%

SevenRooms, Inc. notified MGM Resorts International guests of a data breach involving a third-party file transfer system. Unauthorized access occurred Dec 11-15, 2022, affecting guest names, emails, phone numbers, and health/allergy data. SevenRooms engaged forensic investigators and notified law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 7 weeks / 47 days

Dec 11, 2022

Begins

Dec 15, 2022

Discovered

Jan 31, 2023

Filed

vs. sector median

12 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: SevenRooms, Inc
norm: sevenrooms

Name: MGM Resorts International
norm: mgm resorts international
Industry: TechnologyllmHospitalityllm

Discovered: Dec 15, 2022
Breach occurred: Dec 11, 2022 – Dec 15, 2022
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 1, 2023
Affected individuals: 3state-resident count only
Data types: Identity (basic)Health (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Initiating an internal investigation into this incident
Retaining an independent forensic investigation firm to assist us in our investigation of and response to this incident
Notified law enforcement and will assist them in their investigation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-53.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 31, 2023
Raw hash: 9b661fdb2b31af6a77fd56fa11e4280ebb13c3e992cdb0f4151e9a2064551a2d

Reporting entitySevenRooms, Inc

Victim entityMGM Resorts International

Incidentdiscovered Dec 15, 2022

Stated responseInitiating an internal investigation into this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov