The details of some 10.6 million customers of MGM Resorts International, including celebrities, have found their way online after the company experience a data breach last year.

The customer details were first discovered by an Israeli security researcher going by the name of Under the Breach and provided to ZDNet today.

The data included full names, addresses, phone numbers, dates of birth and email addresses. Some of the records included government officials, chief executive officers and others, notable among them Twitter Inc. CEO Jack Dorsey and singer Justin Bieber.

The breach, since confirmed by MGM Resorts, occurred last year. “Last summer, we discovered unauthorized access to a cloud server that contained a limited amount of information for certain previous guests of MGM Resorts,” an MGM spokesperson said in a statement. “We are confident that no financial, payment card or password data was involved in this matter.” The company added that it had notified guests of the data breach at the time and that the data was “old” in that it only related to bookings up to 2017.

The statement from MGM Resorts would suggest that it failed to secure a cloud-hosted database adequately. The details of how the data breach occurred were not fully disclosed, but if it was a case of failing to secure a cloud database, MGM is far from the first to do so.

Now that the data has been shared on a hacking forum, former guests, which are said to include a long list of Twitter employees, are open to being targeted by phishing attacks.

MGM Resorts is not alone in the hotel industry in having data stolen. Some 500 million customer records were stolen from Marriott International Inc. in November 2018. That data breach was blamed on China. The origin of the MGM breach remains unknown, but given the stolen data was posted to a hacking forum, it’s unlikely state-sponsored actors were behind it.

Photo: Zereshk/Wikimedia Commons