LAS VEGAS, NEVADA: A persistent error caused by a cybersecurity breach occurred in the casino rewards accounts of MGM Resorts International loyalty members on September 10.

After the attacks, hackers could make unauthorized transactions on the saved cards of members.

MGM Resorts, the largest casino operator in Las Vegas, said the incident began last weekend and affected reservations and casino floors in Las Vegas and other states.

They also caused video slot machines to shut down, and some customers said their hotel room cards were not working.

The situation entered its sixth day on September 15, with booking capacities still down and MGM Resorts offering penalty-free room cancelations through September 17.

MGM spokesperson Brian Ahern declined to comment when asked about the incident, including what information had been compromised in the breach.

The same week, the world's largest casino owner, Caesars Entertainment, also said it had been hit by a cybersecurity attack.

While its casino and hotel computer operations were not disrupted, it could not confirm that the attack compromised personal information about tens of millions of its customers, it added.

Yoohwan Kim, a computer science professor at the University of Nevada, Las Vegas, said, "When people think about security, they are thinking about the really big super-computers, firewalls, a lot of security systems."

"Casino giants like MGM Resorts and Caesars are protected by sophisticated and expensive security operations. But no system is perfect," he added.

The hacks may have been carried out as a "socially engineered attack," meaning the hackers used phone calls, text messages or phishing emails to breach the system, said Tony Anscombe, chief security official with the San Diego-based cybersecurity company ESET.

"Security is only as good as the weakest link, and unfortunately, as in many cyberattacks, human behavior is the method used by cybercriminals to gain access to a company's crown jewels," he stressed.

It has not been officially confirmed whether either of the affected companies paid a ransom to the hackers.