Documented social engineering incidents targeting the hospitality, gaming & travel sector, sourced and fact-checked.
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member. Agents found four phones and a USB drive on her; cash and a hidden-camera detector were found in her hotel room. The initial malware assessment of the USB drive was later disputed.
DocumentedMGM Resorts, September 2023. A caller reportedly talked the IT help desk into resetting an employee's access, and the shutdown that followed knocked about $100 million off quarterly property profit. No ransom was paid. Below: what MGM's filings confirm, and what only the attackers said. A documented incident.
DocumentedFIN7 (Carbanak) mailed USPS packages containing BadUSB hardware implants to HR, IT, and executive staff at US retail, restaurant, and hotel companies, aiming to trigger automatic malware installation the moment a curious employee plugged the device in; the one package researchers recovered carried a forged Best Buy gift-card letter, a brand the FBI never named.
DocumentedDOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records describe the fake Combi Security recruitment front; separately reported FBI attribution links FIN7 to later malicious-USB mailings.
DocumentedThe Caesars breach began in August 2023, when someone called its outsourced IT help desk, said they were an employee, and got a password reset. Soon after, the Caesars Rewards database was stolen. Caesars reportedly paid about $15 million, but its SEC filing never puts a number on it. A documented incident, attributed to Scattered Spider.
DocumentedA caller posing as Carnival's IT security team got an employee's login in April 2026. The attacker copied data on nearly 6 million people. What was taken.
DocumentedLazarus hackers used a fake LinkedIn job offer to plant spyware on a Sky Mavis engineer's laptop, then drained $540M from the Ronin bridge in March 2022.
Social Engineering Examples