MGM Resorts and Caesars Entertainment face Scattered Spider/ALPHV cyberattack. Caesars pays $15M ransom and quickly resumes business; MGM refuses to pay, undergoes 10+ days operational downtime. Incident response complex, about 'least worst' decisions. Paying ransom yields no data security guarantee, encourages attacks, yet offers expediency. Rapid recovery from ransom payment may seem effective but carries long-term implications. Recovery costs and business priorities crucial in decision-making. MGM demonstrates long-term cybersecurity focus, Caesars prioritises operations continuity. Both responses were capable, mitigating widespread damage. Incident recovery unpredictable, outcome not measure of success.
