MGM MGM Resorts International

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 8-K

CURRENT REPORT

Pursuant to Section 13 or 15(d)

of The Securities Exchange Act of 1934

Date of Report (Date of earliest event reported): October 5, 2023

MGM Resorts International

(Exact name of registrant as specified in its charter)

(702) 693-7120

(Registrant’s telephone number, including area code)

Not Applicable

(Former name or former address, if changed since last report.)

Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions:

Securities registered pursuant to Section 12(b) of the Act:

Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (17 §CRF 230.405) or Rule 12b-2 of the Securities Exchange Act of 1934 (17 CFR §240.12b-2).

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

The third paragraph (regarding completed results and financial condition), the “Cautionary Statement Concerning Forward-Looking Statements” paragraph, and the two paragraphs thereafter set forth below under Item 7.01 of this Current Report on Form 8-K are incorporated herein by reference.

On September 12, 2023, MGM Resorts International (the “Company”) issued a statement that it had recently identified a cybersecurity issue affecting certain of the Company’s U.S. systems.

Promptly after detecting the issue, the Company responded swiftly and shut down its systems to mitigate risk to customer information, which resulted in disruptions at some of the Company’s properties but allowed the Company to prevent the criminal actors from accessing any customer bank account numbers or payment card information. Since that time, operations at the Company’s domestic properties have returned to normal and virtually all of the Company’s guest-facing systems have been restored. The Company continues to focus on restoring the remaining impacted guest-facing systems and the Company anticipates that these systems will be restored in the coming days.

The Company believes that the operational disruption experienced at its affected properties during the month of September will have a negative impact on its third quarter 2023 results, predominantly in its Las Vegas operations, and a minimal impact during the fourth quarter. The Company does not expect that it will have a material effect on its financial condition and results of operations for the year. Specifically, the Company estimates a negative impact from the cyber security issue in September of approximately $100 million to Adjusted Property EBITDAR for the Las Vegas Strip Resorts and Regional Operations, collectively. While the Company experienced impacts to occupancy due to the availability of bookings through the Company’s website and mobile applications, it was mostly contained to the month of September which was 88% (compared to 93% in the prior year period). The Company believes it is well-positioned to have a strong fourth quarter, with record results expected in November primarily driven by Formula 1. The Company is further forecasting occupancy to be 93% in October (compared to 94% in the prior year period) and to fully rebound in November for the Las Vegas Strip Resorts. The Company has also incurred less than $10 million in one-time expenses in the third quarter related to the cybersecurity issue, which consisted of technology consulting services, legal fees and expenses of other third party advisors. Although the Company currently believes that its cybersecurity insurance will be sufficient to cover the financial impact to its business as a result of the operational disruptions, the one-time expenses described above and future expenses, the full scope of the costs and related impacts of this issue has not been determined.

Based on the ongoing investigation, the Company believes that the unauthorized third-party activity is contained at this time. The Company has determined, however, that the criminal actors obtained, for some of the Company’s customers that transacted with the Company prior to March 2019, personal information (including name, contact information (such as phone number, email address and postal address), gender, date of birth and driver’s license numbers). For a limited number of customers, Social Security numbers and passport numbers were also obtained by the criminal actors. The types of impacted information varied by individual. At this time, the Company does not believe that customer passwords, bank account numbers or payment card information were obtained by the criminal actors. In addition, the Company does not believe that the criminal actors accessed The Cosmopolitan of Las Vegas systems or data. The Company also has no evidence that the data obtained by the criminal actors has been used for identity theft or account fraud. The Company has established a dedicated help line to address questions about this incident, which can be reached at 800-621-9437 toll-free Monday through Friday from 8 am – 10 pm Central, or Saturday and Sunday from 10 am – 7 pm Central (excluding major U.S. holidays). Please reference engagement number B105892 when calling. The Company also has set up a webpage www.mgmresorts.com/importantinformation with additional information. In the coming weeks, the Company will provide notification by email to individuals impacted by this issue as required by law and will offer those individuals free identity protection and credit monitoring services.

While no company can ever eliminate the risk of a cyber attack, the Company has taken significant measures, working with industry-leading third-party experts, to further enhance its system safeguards. These efforts are ongoing.

2

Cautionary Statement Concerning Forward-Looking Statements

Statements in this Current Report on Form 8-K that are not historical facts are forward-looking statements, within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements are based on management’s current expectations and assumptions, are not based on historical facts and are subject to risks and uncertainties, and other important factors that could cause actual results to differ materially from those expressed or implied in the forward-looking statements. Examples of such factors include, but are not limited to: additional information regarding the extent of the cybersecurity issue that the Company may uncover during its ongoing investigation; the Company’s ability to assess and remedy the issue, including the restoration of impacted systems; the Company’s ability to service its customers following the issue and any change in customer behavior as a result of the issue; the scope of personal information that was accessed or obtained by the unauthorized third party and the negative consequences of the illegal or improper use of such information by the unauthorized third party, such as fines, penalties, or loss of reputation, competitiveness or customers; incremental expenses associated with the Company’s on-going assessment of the issue; the nature and scope of any claims, litigation or regulatory proceedings that may be brought against the Company or other affected parties as a result of the issue; the availability of insurance coverage; other legal, reputational and financial risks resulting from this or other cybersecurity issues and the potential impact of this issue on the Company’s revenues, operating expenses, and operating results, including with respect to our expected occupancy rates; the length and scope of disruptions to the Company’s business operations caused by the issue; and the efficacy of the measures that the Company is implementing to further enhance its system safeguards. Additional risks, uncertainties and other important factors are described in the Company’s filings with the Securities and Exchange Commission (the “SEC”), including the Company’s Form 10-K filed with the SEC on February 24, 2023. The Company is not undertaking any duty or obligation to update these statements publicly as a result of new information, future events or otherwise, except as required by law. If the Company updates one or more forward-looking statements, no inference should be drawn that the Company will make additional updates with respect thereto or with respect to other forward-looking statements.

“Adjusted Property EBITDAR” is the Company’s reportable segment GAAP measure, which it utilizes as the primary profit measure for its reportable segments and underlying operating segments. Adjusted Property EBITDAR is a measure defined as earnings before interest and other non-operating income (expense), taxes, depreciation and amortization, preopening and start-up expenses, gain on REIT transactions, net, property transactions, net, rent expense related to triple-net operating leases and ground leases, income from unconsolidated affiliates related to investments in real estate ventures, and also excludes corporate expense and stock compensation expense, which are not allocated to each operating segment. The Company’s reporting of financial impacts and estimated expenses are preliminary. The Company has not yet completed its quarter-end reporting process. Accordingly, final results and other disclosures to be included in the Company’s Quarterly Report on Form 10-Q and complete earnings release may differ materially from preliminary impacts, results and disclosures.

The information furnished pursuant to this Item shall not be deemed to be “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), or otherwise subject to the liabilities of that section, nor shall it be deemed incorporated by reference in any filing under the Securities Act of 1933, as amended, or the Exchange Act, except as shall be expressly set forth by specific reference in such a filing.

3

SIGNATURE

Pursuant to the requirements of the Securities Exchange Act of 1934, as amended, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.

Date: October 5, 2023

4