Vishing (Voice Phishing) Documented incident

MGM Resorts Help-Desk Vishing Hack (2023): One Reset, a $100M Profit Hit

MGM Resorts, September 2023. A caller reportedly talked the IT help desk into resetting an employee's access, and the shutdown that followed knocked about $100 million off quarterly property profit. No ransom was paid. Below: what MGM's filings confirm, and what only the attackers said. A documented incident.

Social Engineering Examples·10 sources

In September 2023, attackers reportedly rang MGM Resorts' IT help desk, said they were an employee, and got that employee's access reset. MGM later estimated a hit of about $100 million to third-quarter Adjusted Property EBITDAR, which is a profit measure. Shutting systems down to contain the intrusion disrupted its properties for roughly ten days. MGM also reported under $10 million in one-time costs and didn't pay a ransom. Status: Documented incident.

Key takeaways

The two details everyone repeats, an employee found on LinkedIn and a ten-minute call, come from the attackers. MGM's SEC filings never say how the intruders got in.
The $100 million is MGM's estimate of lost segment profit (Adjusted Property EBITDAR). It isn't lost revenue, a fine or a ransom.
What failed was the identity check on a reset request. The FBI and CISA describe exactly this help-desk tactic in their November 2023 advisory on Scattered Spider.
The lawsuits and the FTC inquiry have wrapped up. The FTC dropped its demand in February 2025, and in June 2025 a court gave final approval to a $45 million settlement that also covers a 2019 breach.

The MGM hack: what MGM confirmed, and what only the attackers claimed

Most write-ups of the MGM hack mix three very different sources: MGM's own filings, a government advisory about the group blamed for it, and the attackers' own statements. They don't deserve the same weight, so here they are pulled apart.

Detail	Who says so	Status
Systems shut down after a cybersecurity issue	MGM 8-K (Oct. 5, 2023)	Confirmed by MGM
About $100M EBITDAR hit, under $10M one-time costs	MGM 8-K	Confirmed by MGM (estimate)
Data taken for some pre-March 2019 customers	MGM 8-K	Confirmed by MGM
A caller posing as an employee got access reset	ALPHV, via vx-underground (Sept. 12, 2023)	Reported, not confirmed by MGM
Employee found on LinkedIn, a ten-minute call	The same attacker claim	Unconfirmed attacker claim
Okta and Azure admin control, 100+ ESXi hosts encrypted	ALPHV statement (Sept. 14, 2023)	Unconfirmed, not in MGM's filings
Scattered Spider worked with ALPHV/BlackCat	Threat-intel reporting, Reuters	Widely reported; MGM only says "criminal actors"

Example: the most quoted line about this case, that MGM was "defeated by a 10-minute conversation," is ALPHV's own boast. Two days later its formal statement told a different story, saying it had been sniffing passwords on MGM's Okta Agent servers.

How the MGM hack went from one reset to a company-wide outage

These steps put MGM's filings together with the reported attack path. Where a step depends only on the attackers' word, it says so.

Reconnaissance: Scattered Spider profiles staff using social media, open-source information, commercial tools and data leaks, according to the FBI and CISA. The attackers said they picked an MGM employee off LinkedIn.
Pretext and first contact: someone called MGM's IT help desk pretending to be that employee and asked for help getting back into their account. That's vishing, aimed at a support desk instead of a customer.
Access: the help desk reset the account's credentials or MFA, which handed over a working login without anyone having to beat MFA. That's account takeover through the reset process, not MFA fatigue.
Escalation: the attackers say they went from there to admin control of MGM's Okta identity platform and its Azure cloud tenant.
Exfiltration: customer personal data went out the door. MGM confirmed that part in its October 2023 filing.
Impact and extortion: when MGM started cutting them off, ALPHV says it encrypted more than 100 ESXi hypervisors. MGM wouldn't pay.

Example: MGM's 8-K puts September occupancy at 88%, down from 93% a year earlier, because bookings through its website and mobile apps were hit.

MGM hack timeline, September 2023 to June 2025

Date	Event	Source
September 11 and 12, 2023	MGM discloses a "cybersecurity issue" and shuts down large parts of its IT systems	MGM Form 8-K
September 12, 2023	vx-underground passes on ALPHV's claim that a help-desk call opened the network	SecurityWeek
September 13, 2023	Moody's calls the breach credit-negative as the disruption drags on	Reuters
September 14, 2023	ALPHV claims Okta and Azure admin access and encryption of more than 100 ESXi hypervisors	BleepingComputer
October 5, 2023	MGM estimates the financial impact and confirms which customer data was taken	MGM Form 8-K
November 16, 2023	AA23-320A comes out. The FBI and CISA describe Scattered Spider's help-desk calls	CISA
January 22, 2025	Preliminary approval for a $45 million class settlement, 2019 and 2023 breaches combined	U.S. District Court, District of Nevada
February 25 and March 3, 2025	The FTC withdraws its civil investigative demand, and a week later its enforcement action is dismissed without prejudice, with each side paying its own costs	FTC v. MGM stipulation
June 18, 2025	Final approval of the $45 million settlement	U.S. District Court, District of Nevada

What the MGM cyberattack cost, line by line

These figures are on different bases. Don't add them up.

Component	Amount	Basis
Q3 2023 Adjusted Property EBITDAR	About $100 million negative impact	MGM's estimate. A profit measure, not revenue, a fine or a theft
One-time expenses (consulting, legal, advisors)	Under $10 million	Reported by MGM for Q3 2023
Ransom	None paid	MGM refused to pay
Class-action settlement	$45 million	Covers the July 2019 and September 2023 breaches, not just 2023
Insurance	Not quantified	MGM expected cyber insurance to cover the impact

Example: plenty of write-ups call the $100 million "lost revenue." MGM's 8-K defines Adjusted Property EBITDAR as the main profit measure for its operating segments, which isn't the same number as revenue.

MGM and Caesars: same playbook, opposite ransom decisions

Two Las Vegas casino operators were hit a few weeks apart in 2023 by help-desk social engineering usually blamed on the same group. (A group representative first denied any role at Caesars.) How they responded couldn't have been more different.

	MGM Resorts	Caesars Entertainment
Help desk reached	MGM's own, according to the reported account	An outsourced IT support vendor, later named in litigation as Coforge
Data taken	Some pre-March 2019 customer data	The Caesars Rewards loyalty database
Ransom	None paid	About $15 million reportedly paid, no amount in its 8-K
SEC 8-K	October 5, 2023, with an impact estimate	September 14, 2023

Example: in both cases they attacked the reset process rather than any technology, which means the fix is the same for an in-house desk and an outsourced one. Read the Caesars vendor help-desk case.

The help-desk check that failed, and what would have stopped it

There was one point where the whole thing could have ended: the reset. By the reported account, the request came in by phone and was approved on personal details of the kind anyone can find on public profiles or in leaked data. Each control below is matched to the stage it would have broken.

Stage	Control	Why it matters here
Access (the reset)	No reset on knowledge answers alone. Confirm identity another way, like a callback to a number on file, manager approval or a video ID check	Personal facts were the only proof needed, according to the reported account
Access (the reset)	A second approver, or an in-person check, for admin accounts	One reset became control of identity systems, according to the attackers
Persistence	Alert on new MFA devices and identity-provider changes	The FBI and CISA say the group registers its own MFA tokens and adds a federated identity provider
Escalation	Phishing-resistant MFA for admins. Protect identity platforms the way you'd protect domain controllers	The identity platform unlocks every system connected to it
Impact	Offline, immutable backups. Keep identity systems separate from virtualization hosts	Limits what ESXi encryption can knock out

Lessons for help desks, security teams and leadership

Help-desk leads: write a reset script nobody can talk their way past, and make outsourced desks follow it too. That same autumn, Caesars was breached through its IT support vendor, and Clorox alleges Cognizant's help desk reset MFA on request.
Security teams: your identity platform is the crown jewel. Watch every federation and MFA change, and rehearse the decision to take systems offline. MGM says its shutdown kept the attackers away from bank and payment card data. The same shutdown is what caused the disruption.
Executives and boards: most of the disclosed cost was lost operating profit, not response fees. Work out ahead of time what pulling the plug would do to the business. And the FBI and CISA don't encourage paying ransoms.
Trainers: drill this exact call. A polite person with a believable access problem. See how to prevent vishing for a checklist.

What's still unknown about the MGM breach

How they really got in. ALPHV told two stories: a help-desk call, then password sniffing on Okta Agent servers. MGM hasn't confirmed either.
Which account was reset, and whether it had administrator rights at the time.
How Scattered Spider and ALPHV split the work. MGM has never named the attackers.
Whether anyone will be charged for this intrusion. No prosecution so far names MGM as a victim. One loose thread: at a September 2025 hearing, UK prosecutors said crypto seized from one defendant included funds linked to the Las Vegas casino hacks.

MGM hack: common questions

How did the MGM hack happen?

The reported route is a phone call to MGM's IT help desk from someone posing as an employee, followed by a reset of that employee's access. That version comes from the attackers, and it matches how the FBI and CISA describe Scattered Spider's methods. MGM's own SEC filings confirm the break-in, the shutdown and the stolen data. On how the attackers got in, they're silent.

Did MGM pay the ransom?

No. MGM refused and took the outage instead. Caesars Entertainment, hit by a similar help-desk attack a few weeks earlier, reportedly paid about $15 million to keep stolen loyalty data private, though its SEC filing doesn't give an amount. The FBI and CISA advise against paying, since it doesn't guarantee recovery and can encourage more attacks.

How much did the MGM cyberattack cost?

MGM estimated a negative impact of about $100 million to third-quarter 2023 Adjusted Property EBITDAR, plus under $10 million in one-time costs, and expected insurance to cover the impact. A separate $45 million class settlement covers both a 2019 breach and the 2023 attack. The figures sit on different bases, so adding them would overstate what the 2023 incident cost.

Who hacked MGM Resorts?

The attack is widely blamed on Scattered Spider, also tracked as UNC3944 and Octo Tempest, working with the ALPHV/BlackCat ransomware operation. That attribution rests on threat-intelligence reporting and the attackers' own statements. MGM's filings only mention "criminal actors," and the original November 2023 FBI and CISA advisory tied Scattered Spider to BlackCat/ALPHV ransomware in general terms.

What data was stolen in the MGM data breach?

For some customers who did business with MGM before March 2019, the attackers got names, contact details, gender, dates of birth and driver's license numbers. A limited number also lost Social Security and passport numbers. MGM said it didn't believe passwords, bank account numbers or payment card data were taken, or that The Cosmopolitan of Las Vegas systems were accessed.

Sources

Form 8-K, MGM Resorts International (cybersecurity issue disclosure, financial impact and data exposed). U.S. Securities and Exchange Commission (EDGAR) (primary).
Form 10-K for fiscal year ended December 31, 2023 (Item 1C Cybersecurity; 'Cybersecurity Issue' risk factors and legal proceedings). U.S. Securities and Exchange Commission (EDGAR) (primary).
Scattered Spider: Joint Cybersecurity Advisory AA23-320A. FBI and CISA (with RCMP, ASD/ACSC, AFP, CCCS, NCSC-UK) (primary).
MGM Resorts breached by 'Scattered Spider' hackers: sources. Reuters (secondary).
MGM Resorts confirms hackers stole customers' personal data during cyberattack. TechCrunch (secondary).
MGM Says Computer Hack Will Cost It $100 Million. Bloomberg (secondary).
Ransomware Gang Takes Credit for Disruptive MGM Resorts Cyberattack. SecurityWeek (secondary).
MGM casino's ESXi servers allegedly encrypted in ransomware attack. BleepingComputer (secondary).
Order granting plaintiffs' motion for final approval of class action settlement and final judgment, In re MGM International Resorts Data Breach Litigation (No. 2:23-cv-01480). U.S. District Court for the District of Nevada (primary).
Stipulation of Dismissal, Federal Trade Commission v. MGM Resorts International (No. 2:24-cv-01112). U.S. District Court for the District of Nevada (primary).

Cite this case

Social Engineering Examples. “MGM Resorts Help-Desk Vishing Hack (2023): One Reset, a $100M Profit Hit”. Accessed 3 November 2026. https://socialengineeringexamples.com/mgm-resorts-scattered-spider-vishing-2023

Attack Chain & Defense

1Reconnaissance

What happened

Per FBI/CISA advisory AA23-320A, the group profiles staff from "personal information derived from social media, open-source information, commercial intelligence tools, and database leaks." The LinkedIn detail in the MGM story comes from the attackers.