Bet On It: MGM discloses impact from cybersecurity breach

Welcome to the latest edition of “Bet On It,” where The Fly looks at news and activity in the sports betting and iGaming space.

SECTOR NEWS: According to a regulatory filing, on September 12, MGM Resorts (MGM) issued a statement that it had recently identified a cybersecurity issue affecting certain of the company’s U.S. systems. Promptly after detecting the issue, the company responded and shut down its systems to mitigate risk to customer information, which resulted in disruptions at some of the company’s properties but allowed the company to prevent the criminal actors from accessing any customer bank account numbers or payment card information. Since that time, operations at the company’s domestic properties have returned to normal and virtually all of the company’s guest-facing systems have been restored. The company continues to focus on restoring the remaining impacted guest-facing systems and the company anticipates that these systems will be restored in the coming days. The company believes that the operational disruption experienced at its affected properties during the month of September will have a negative impact on its third quarter 2023 results, predominantly in its Las Vegas operations, and a minimal impact during the fourth quarter. The company does not expect that it will have a material effect on its financial condition and results of operations for the year. Specifically, the company estimates a negative impact from the cyber security issue in September of approximately $100M to adjusted property EBITDAR for the Las Vegas Strip Resorts and Regional Operations, collectively. While the company experienced impacts to occupancy due to the availability of bookings through the company’s website and mobile applications, it was mostly contained to the month of September which was 88%, compared to 93% in the prior year period. The company believes it is well-positioned to have a strong fourth quarter, with record results expected in November primarily driven by Formula 1. The company is further forecasting occupancy to be 93% in October, compared to 94% in the prior year period, and to fully rebound in November for the Las Vegas Strip Resorts. The company has also incurred less than $10M in one-time expenses in the third quarter related to the cybersecurity issue, which consisted of technology consulting services, legal fees and expenses of other third party advisors. Although the company currently believes that its cybersecurity insurance will be sufficient to cover the financial impact to its business as a result of the operational disruptions, the one-time expenses described above and future expenses, the full scope of the costs and related impacts of this issue has not been determined. Based on the ongoing investigation, the company believes that the unauthorized third-party activity is contained at this time. The company has determined, however, that the criminal actors obtained, for some of the company’s customers that transacted with the company prior to March 2019, personal information (including name, contact information. For a limited number of customers, Social Security numbers and passport numbers were also obtained by the criminal actors. The types of impacted information varied by individual. At this time, the company does not believe that customer passwords, bank account numbers or payment card information were obtained by the criminal actors. In addition, the company does not believe that the criminal actors accessed The Cosmopolitan of Las Vegas systems or data. The company also has no evidence that the data obtained by the criminal actors has been used for identity theft or account fraud. In the coming weeks, the company will provide notification by email to individuals impacted by this issue as required by law and will offer those individuals free identity protection and credit monitoring services. “While no company can ever eliminate the risk of a cyber attack, the company has taken significant measures, working with industry-leading third-party experts, to further enhance its system safeguards. These efforts are ongoing,” MGM stated.

Super Group (SGHC) announced that it has ceased providing any services to the Indian market due to changes to the Indian Goods and Services Tax, effective as of October 1 The newly effective tax rules make the Indian market no longer commercially viable for Super Group. Despite this development, Super Group reaffirms the full year financial projections provided on the earnings conference call on August 17. Neal Menashe, CEO of Super Group, stated: “We are continuously evaluating evolving regulatory landscapes across the many markets we serve. Informed by years of operating our geographically diverse business, we remain confident about the long-term growth opportunities in front of us.”

Elys Game Technology (ELYS) announced the successful installation of its North American server infrastructure located at the Continent 8 Data Center in Cincinnati, Ohio. “The multimillion-dollar technology footprint establishes the hub of Elys’ platform in Ohio and extends its network across multiple spokes throughout North America,” the company said. Meanwhile, the company is working on obtaining regulatory approvals for the launch of tribal distribution in Michigan, North Dakota and New Mexico. Additionally, the company plans to expand its non-tribal commercial operations in Washington D.C. and establish commercial operations in Ohio, Maryland and New Jersey. The company is also exploring opportunities for future mobile operations in multiple U.S. states and Canadian provinces over the next six to eight months.

Macau reported September casino revenue up 404.2% to 14.94B patacas. 

The New York state gaming commission unanimously approved Fanatics Sportsbook to operate in the state. A Fanatics spokesperson issued the following statement: “Today, the New York State Gaming Commission approved Fanatics Betting and Gaming’s acquisition of PointsBet New York LLC. We would like to thank the commissioners and staff of the New York State Gaming Commission for their time and effort in delivering us some great news today. We look forward to working with the staff of the New York State Gaming Commission to bring the Fanatics Sportsbook to the largest sports wagering state in the U.S.

FOOTBALL HOLD: According to Macquarie’s proprietary hold model, the firm calculated football market hold of 5% for the week of September 25–October 1. The firm estimates that the NFL represented 67% of football betting this week. Heavy favorites went 2-1-1 in primetime games against the spread, which helped drive a negative week for sportsbooks on NFL spread bets. The firm estimated college accounted for 33% of football betting this week.

CLOSING THE GAP: Canaccord told investors that DraftKings (DKNG) has continued to gain market share in many of the states that report operator-level data, with its handle share in New York and Illinois increasing from 28% and 30%, respectively, in August 2022 to 40% and 38% in August 2023. Additionally, the firm noted DraftKings’ strong start in Ohio and Massachusetts, leading handle in both. FanDuel’s (PDYPY) share of gross gaming revenue, or GGR, continues to outperform its share of handle in most states, helping it retain the leading GGR market share position across the US, although DraftKings is slowly closing this gap. For example, DraftKings’ handle and GGR in New York is up 65% and 43% year-over-year, respectively, quarter to date through September 24th compared to 19% and 1% for FanDuel.

BANNED: New York sports betting regulators decided to prohibit fantasy sports games that mirror player prop bets offered by sportsbooks, Sam McQuillan of Legal Sports Report wrote. New York State Gaming Commissioners on Thursday unanimously agreed to adopt NY sports betting Rule 5602.1(a)(4), which makes “explicit that (fantasy) contests shall not be based on proposition betting or contests that have the effect of mimicking proposition betting.” This comes to the chagrin  of the Coalition for Fantasy Sports, which represents PrizePicks, Underdog Fantasy and Sleeper, the top three fantasy sports operators to offer “pick ’em” games. 

ADDITIONAL ANALYST COMMENTARY: Guggenheim lowered the firm’s price target on DraftKings to $37 from $38 and keeps a Buy rating on the shares. The firm’s analysis of third-party app data continues to show strong trends at DraftKings through the third quarter and the firm’s full-year revenue and EBITDA estimates are now $3.55B and ($171M), which are both “modestly ahead of company guidance,” the analyst tells investors.

PUBLICLY TRADED COMPANIES IN THE SPACE INCLUDE: Accel Entertainment (ACEL), Bally’s (BALY), Boyd Gaming (BYD), Caesars (CZR), Churchill Downs (CHDN), DraftKings (DKNG), Flutter Entertainment (PDYPY), Gambling.com (GAMB), Gan Limited (GAN), Genius Sports (GENI), Las Vegas Sands (LVS), MGM Resorts (MGM), Penn Entertainment (PENN), Rush Street Interactive (RSI), Super Group (SGHC) and Wynn Resorts (WYNN).