It was past midnight when Alessandra Millican and a friend entered the Bellagio hotel room that was costing them hundreds of dollars a night, but unexpected noises made them stop cold.<\/p>\n
\u201cWe started hearing grunts,\u201d she said. \u201cIt\u2019s somebody waking up \u2014 we were halfway through the room and we realized there\u2019s somebody sleeping in here.\u201d<\/p>\n
Millican had arrived in Las Vegas on Sunday, Sept. 10, just as an online attack was being discovered by MGM Resorts International Unfortunately for Millican and her friend, the hot water was not reliable in their first room, which forced them to brave the front desk late Tuesday night into Wednesday morning. Millican said the process was long and manual, with one employee accessing a single spreadsheet for each check-in, which typically took about a half hour for each guest even after they made it to the front of the line.<\/p>\n That seemed like a minor annoyance once they arrived at their new room to find a sleeping guest. And Millican said she learned it was not an isolated incident.<\/p>\n \u201cWhen I went around the hotel and talked with people, almost all of them have the exact same experiences,\u201d she said. \u201cThis guest I talked to said his friend was walked in on, and his other female friend had her door opened while she was in the shower.\u201d<\/p>\n This is not the typical effects of a cyberattack that consumers have been conditioned to accept. Many consumers are now accustomed to receiving notification of a data breach, with an email listing their personal information that may have been accessed and offering free identity-protection services. <\/p>\n Recent cyberattacks are not only impacting hotel stays, but also basic consumer products like kitty litter and cleaning wipes.\u00a0Facing real-world effects is relatively new, and experts believe the in-person intrusions and disappointment could lead to increasing backlash from consumers. <\/p>\n Millican has now weathered both types of experiences. She was also wrapped up in the 2017 Equifax Inc. EFX In One Chart: The full toll of the massive Equifax data breach<\/strong><\/p>\n A charge on her credit card, however, changed that outlook. As Millican slept in Las Vegas on Thursday morning, someone charged $14.11 on the same credit card she used at the Bellagio at a bar in New York, even though that bar wasn\u2019t open when the charge was made before noon on the East Coast.\u00a0<\/p>\n \u201cObviously now I think it\u2019s going to continue to unfold, and when I got that false charge on my card, that\u2019s when alarm bells start going off like, \u2018OK, this is real. This is a situation that I need to be on alert about,’\u201d she said.<\/p>\n As Millican was dealing with real-world effects from the MGM attack last week, Renee Lytle was a couple hundred miles away in Southern California at a PetSmart location, trying to buy Fresh Step kitty litter for her two cats, Pip and Cali. When she couldn\u2019t find the product, she instead grabbed a competing brand, and her pets registered their disdain for the switch in a way that won\u2019t be surprising to cat owners.<\/p>\n \u201cThey\u2019re just like, \u2018OK mom, this is what\u2019s going down \u2014 We\u2019re pooping and peeing around the box until you get us our litter,\u2019\u201d she said.<\/p>\n Clorox Co. CLX For more: Clorox Warns That a Cyberattack Will Hurt Its Earnings. It Isn\u2019t Alone.<\/strong><\/p>\n \u201cWhen you look at these particular attacks, they\u2019re disrupting trust,\u201d said Lida Citro\u00ebn, a reputation-management expert and author. \u201cWe trust our products until we can\u2019t get them when we go to the store and the shelves are empty. It\u2019s all about trust, and consumers want trust. A reputation crisis is when trust is broken.\u201d<\/p>\n The visceral nature of facing in-real-life effects from a digital attack can lead customers to break up with a brand for good, said Eric Yaverbaum, author of seven books on public relations and crisis management.<\/p>\n \u201cNow it\u2019s touching me for real, it\u2019s not just some story in the news. I can\u2019t get my Clorox and what\u2019s over to the left of them is a competing product,\u201d Yaverbaum, chairman of public-relations firm Ericho communications, told MarketWatch. \u201cInevitably, not everybody goes back to Clorox when they get their distribution back. That\u2019s real, that\u2019s not a story, not something that happened to a neighbor \u2014 it happens to us. And when it touches us, you know, different buying decisions are made.\u201d<\/p>\n These issues could also lead to higher prices. A ransomware attack on the Colonial Pipeline Co. in 2021 increased gas prices in much of the U.S., and a successful attack on meatpacking company JBS SA \u201cThe costs are passed along to the consumers, and the costs are also impacting shareholders,\u201d Pete Nicoletti, global chief information security officer at Check Point Software Lytle said she would go to several stores to attempt to find the Fresh Step litter her cats demand, but said that if the price ever hit $30 for a 30-pound bag \u2014 she currently pays $23 to $24 \u2014 she would have to find a new brand.\u00a0<\/p>\n \u201cThere\u2019s no way I\u2019m paying $30 for a bag of litter,\u201d she said.<\/p>\n Clorox executives have not disclosed the exact type of attack they suffered, but the MGM attack is a case of ransomware, according to Okta Inc. Ransomware is typically involved when corporations face cyberattacks that result in serious disruptions of their operations. Ransomware gangs typically breach a network to lock users out and can steal important data until they receive a large ransom.<\/p>\n See also:<\/strong> <\/strong>Ransomware boom comes from gangs that operate like cloud-software unicorns \u2014 \u2018a truly incredible business model\u2019<\/strong><\/p>\n Bradbury said MGM was one of five Okta customers that had fallen prey to a similar approach this summer. One of the others was Caesars Entertainment Inc. While MGM properties were flailing when Millican was in Las Vegas before announcing that operations were back to normal this week, Caesars properties were reportedly functioning normally. That could be because Caesars management decided to pay the requested ransom, as Bloomberg News reported.<\/p>\n Cybersecurity experts adamantly suggest that companies not pay the ransom.<\/p>\n \u201cYou cannot pay criminals. You can\u2019t let them win,\u201d Check Point\u2019s Nicoletti said, adding that there\u2019s no guarantee a payment will lead to ransomware gangs immediately handing over the keys to a computer system, nor to deleting any data they\u2019ve already obtained.<\/p>\n Ransomware is already \u201cthe most significant threat to businesses,\u201d according to Check Point\u2019s midyear report, which counted more than 2,200 victims in the first half of 2023. Ransomware gangs are proliferating and increasing their attacks at ever higher rates, the cybersecurity company found.<\/p>\n \u201cThe fact that we\u2019re paying these folks billions of dollars means we\u2019re making them better,\u201d he added.<\/p>\n Consumers may see it differently, however. Millican \u2014 who had heard around Las Vegas that Caesars had also been hacked and reportedly paid a ransom to maintain business during a busy week with several conferences in town \u2014 said she would likely not stay at the Bellagio or any other MGM property again \u201cbecause of the price we paid and the experience we received.\u201d<\/p>\n \u201cIn the future, I\u2019d probably be more likely to book at Caesars,\u201d she told MarketWatch. \u201cThey paid the ransom, they got that resolved quickly, but in my mind as a consumer, they took the right step so that my trip won\u2019t be impacted. Because 99% of the time that I\u2019m going to Vegas, I\u2019m going there to have fun.\u201d<\/p>\n While Nicoletti hopes executives don\u2019t take the wrong lesson from this experience and start paying ransoms, he does believe that real-world problems from a cyberattack should be a \u201cwake-up call\u201d for consumers, who should \u201creally look at the people they have relationships with, and look to see what their security posture is.\u201d<\/p>\n Yaverbaum agrees, saying \u201cfor mainstream America \u2014 us pedestrians who just buy stuff, all of us \u2014 the only way that we\u2019re going to get educated and be aware is the hard way.\u201d<\/p>\n \u201cThis is going to touch every single company, every single consumer in this country over the course of the next decade, bar none,\u201d he said. \u201cIt\u2019s not a crazy prediction to make. We\u2019re not ready for what\u2019s coming.\u00a0\u201c<\/p>\n<\/p><\/div>\n
\n MGM,
\n
\n the parent company of the Bellagio. By Monday, she said there were hourslong lines to check in and restaurants were only accepting cash, even though the casino-hotel\u2019s ATMs were not working.<\/p>\n
\n EFX,
\n
\n data breach, which she at first considered more scary than what she experienced at the Bellagio \u201cbecause of the hilarity of fiasco after fiasco and the way that MGM handled the situation.\u201d\u00a0<\/p>\nHow a cyberattack led to cats peeing on their owner\u2019s floor<\/strong><\/h2>\n
\n CLX,
\n
\n which owns the Fresh Step brand, has also recently been dealing with a cyberattack. Clorox\u2019s products have started disappearing from shelves more than a month after the company first reported an online intrusion on Aug. 14, as the company has had to revert to manual processes as systems are offline, undermining production and distribution of various products. The company has admitted those issues in regular updates tracking the recovery progress, and a spokeswoman referred MarketWatch to those updates when asked for comment, but experts say that the issues will continue even after the situation is resolved.<\/p>\n
\n JBSAY,
\n
\n temporarily increased meat prices the same year. Companies could also seek to recoup lost revenue after the shortage passes.<\/p>\n
\n CHKP,
\n
\n told MarketWatch.<\/p>\n\u2018You cannot pay criminals. You can\u2019t let them win\u2019<\/h2>\n
\n OKTA,
\n
\n Chief Security Officer David Bradbury. He confirmed to MarketWatch that a member of a suspected ransomware group had managed to convince a help-desk worker at MGM that they were a specific employee of the company to gain entry.<\/p>\n
\n CZR,
\n
\n a competing hotel-casino company, Bradbury confirmed. Neither MGM nor Caesars returned requests for comment, though both have disclosed recent breaches to the Securities and Exchange Commission.<\/p>\n