MGM Extends Cybersecurity Help to Boyd Gaming After High-Profile Breach

MGM’s Offer of Direct Support

When Boyd Gaming revealed in a federal filing that an unauthorized third party had accessed its internal IT systems and stolen sensitive employee data, MGM’s technology chiefs acted quickly.

John Branden Newman, MGM’s chief technology officer, told the Nevada Gaming Commission that his team contacted Boyd immediately to offer help. Coordination, he said, ran through MGM’s current chief information security officer, who handled the outreach while Boyd began notifying affected individuals and regulators.

Newman emphasized that, although MGM could not speak for Boyd, the offer reflected a sense of shared risk: “It’s obviously unfortunate that a lot of the players in the industry and various industries are still getting hit by these same types of attacks.”

Learning From MGM’s Own 2023 Breach

The offer carries extra weight because MGM itself endured a devastating cyberattack in 2023. At that time Newman was the company’s chief information security officer, leading the response as slot machines froze, hotel systems went dark and losses mounted in the tens of millions.

He told regulators that his team “rebuilt the environment from the ground up” and added “numerous controls to reduce the risk” of future incidents. MGM now tracks threat actors across the gaming sector and works closely with the FBI to identify those behind high-profile hacks. Those lessons, Newman suggested, are precisely what his team is sharing with Boyd.

A Broader Industry Problem

The exchange between MGM and Boyd unfolded during Newman’s suitability hearing before the Nevada Gaming Commission, where commissioners asked about both the current Boyd breach and the still-ongoing investigations into MGM’s 2023 attack.

Newman described how criminal groups such as “Scattered Spider” recruit teenagers as the “last mile” to breach systems while the organizers remain hidden.

Commission Chair Jennifer Togliatti called it “remarkable” and “nuts” how young some suspects are, warning that regulators and operators alike must adapt quickly to a shifting threat landscape. The 17-year-old charged in connection with the MGM hack faces multiple counts of using stolen data, extortion and unlawful computer acts.