Inside the MGM Resorts Cyberattack: Social Engineering, Identity Security, and Resilience
In September 2023, MGM Resorts suffered a major cyberattack that disrupted hotel operations, slot machines, digital room keys, and reservations for roughly ten days, costing an estimated $100 million. Attackers linked to Scattered Spider (an ALPHV/BlackCat affiliate) reportedly used LinkedIn reconnaissance and a short vishing call to the IT help desk, impersonating an employee to reset credentials and MFA. This granted access to MGM’s Okta identity platform and Azure environment, enabling escalation and ransomware deployment against ESXi hypervisors.
MGM’s SEC filings confirmed the financial impact, system shutdowns for containment, and theft of personal data (names, contact details, dates of birth, driver’s licenses, and limited Social Security/passport numbers) from some pre-March 2019 customers. No payment-card or banking data was taken.
The incident underscores critical lessons: harden help-desk verification beyond knowledge-based checks, enforce phishing-resistant MFA, apply least privilege and identity segmentation, monitor for anomalous identity changes, and strengthen incident response. Identity has become the primary attack surface; a single procedural gap can cascade into enterprise-wide operational failure.
