MGM: casino hack shows investors need to think more about cyber security risks

Receive free Lex updates

we will send you myFT Daily Digest Email summary of latest information Lex There is news every morning.

Linking executive pay to performance on social and environmental goals is an increasingly common practice among large U.S. companies. Is it time to bring cybersecurity into the mix? As cyberattacks continue to increase in frequency and severity, investors should be asking this question.

Casino operators MGM Resorts and Caesars Entertainment are the latest high-profile victims.

MGM, the largest hotel-casino operator on the Las Vegas Strip, was forced to shut down much of its internal network this week due to a cybersecurity breach, causing widespread damage to its hotels. Slot machines and digital hotel room keys stopped working. Online booking and credit card system failed.

Then Thursday, Caesar disclose It was the target of cyberattacks this summer. Hackers gained access to the information of “a large number of members” of its loyalty program, including driver’s license numbers and possibly Social Security numbers.

The full scope of the breach is unclear. Caesars Group has reportedly paid a $15 million ransom to hackers. Moody’s believes MGM’s violations have a “credit negative impact” on the company. The company said it may incur lost revenue and remediation costs. At least the damage to their respective market caps was limited this week, with losses of less than 5%.

Even so, incorporating cybersecurity performance metrics into incentive programs has gained some credibility.Nine Fortune 100 companies reportedly did so last year an analysis Proxy Statement and Form 10-K filed by Ernst & Young. This compares to zero in 2018.

The problem has become serious enough that regulators have tightened disclosure requirements for cybersecurity vulnerabilities. America’s litigious culture doesn’t help. Hacking can ultimately cost a company dearly. Credit ratings company Equifax has spent at least $1.4 billion to resolve consumer and state lawsuits and make technology upgrades after a massive data breach in 2017. Corporate boards should take note.