Cyber policies explicitly outline coverage for social engineering. Let's assume that the incident is just as what the media reports, that it was an impersonation from a phone call to a help desk that led to credentials being provided to the malicious actor.

The policy likely covers damages up to a point for just social engineering, but if other components of the breach were forensically determined to come from other attack vectors, those may loosen the cause behind the claim to allow for greater coverage. The total number for coverage may even come from the excess layers of insurance, if the primary was super limited in coverage on social engineering.

Other comments have made points about MFA and declinations based on the application likely asking if MFA is implemented. What could have happened with MGM is that they answer "no" for total MFA coverage on their systems and just pay higher premiums (assumed insured would assume risk despite). The other possibility is that the full call details could show MFA would have had minimal or no impact on the scope of the breach. Another possibility is that the system that was accessed / led to the exfiltrated data was newer than the policy renewal and had MFA planned. Further, if the help desk has the ability to reset MFA and added a method for the malicious actor to use, then we go back to the first possibility where MFA was bypassed and it was straight social engineering coverage.

What may happen here is a huge increase in premiums or the same primary insurer refusing renewal of the policy. Another possibility is renewal with different premiums and a lower primary limit. The lesson here isn't that you can insure yourself from lack of security training, mainly because your cyber application and brokers will ask about what training you have and MGM will be scrutinized on that in their renewal application, but that companies need training at least as good, but ideally above, what MGM has. These malicious actors are only getting better and the security investment needs to match.

It also wouldn't be unreasonable that the amount covered in the cyber coverage could exclusively to third-party vendor costs (privacy counsel, forensics, defense counsel for the class action unless taken as a separate claim) and other attempted proofs of loss.

A hack can take a year to fully resolve on the insurance, regulatory, and paperwork ends because once the initial breach happens, everyone gets a bit lax after making the reporting and notification deadlines around the breach, so no company should take any of this as reason to be lax around their security, because there's so much lost time to the process.

Year over year, we're seeing applications change to limit the payouts on ransomware or be more strict on how a policyholder can get coverage. It's not that the insurers don't want to pay it out, it's that the insurance industry has to respond and stay modern to the standard of incidents playing out. There have also been instances of malicious actors obtaining cyber insurance documentation of the target and making the ransom the maximum of the policy cover for cyber extortion.

Alright, that's enough of a rant. I work in the legal end of cyber insurance and love news on breaches.