Caesars told U.S. regulators it could not guarantee personal data wasn't stolen, while MGM Resorts reported some of its operations were still impacted from its own cyberattack.