MGM Resorts Help-Desk Vishing Breach (Scattered Spider, 2023)

What Happened

In September 2023, MGM Resorts International suffered a major intrusion that paralyzed operations across its Las Vegas and regional properties. MGM publicly disclosed a "cybersecurity issue" on September 11-12, 2023, and responded by shutting down large portions of its IT estate to contain the attackers. For roughly ten days, slot machines, digital room keys, ATMs, point-of-sale, reservation and booking systems, and the company website and mobile apps were degraded or offline, with hotel guests checked in by hand.

The intrusion is widely attributed to the social-engineering crew Scattered Spider (UNC3944), working alongside the ALPHV/BlackCat ransomware operation. According to threat-intelligence reporting and the attackers' own public statements, the group did not exploit a software vulnerability or use stolen malware for initial access. Instead, they researched an MGM employee on LinkedIn and then called MGM's IT help desk impersonating that person, persuading the help desk to reset the account's access.

That foothold was escalated to administrative control of MGM's Okta single-sign-on identity platform and Azure cloud tenant, from which the attackers moved laterally. After MGM detected the activity and began cutting off access, the ALPHV affiliates deployed ransomware against roughly 100 ESXi hypervisors. MGM declined to pay a ransom.

In its October 5, 2023 SEC Form 8-K, MGM estimated the September disruption would reduce third-quarter Adjusted Property EBITDAR by approximately $100 million (concentrated in Las Vegas Strip and regional operations) and reported under $10 million in one-time expenses for technology consulting, legal, and other advisors, expecting cyber insurance to substantially cover the impact.

The filing also disclosed that attackers obtained personal information for customers who had transacted with MGM before March 2019: names, contact details, gender, date of birth, and driver's license numbers, plus Social Security and passport numbers for a limited subset, while stating that passwords, bank account numbers, and payment card data were not obtained.

The incident drew FTC scrutiny (which MGM contested in court), multiple state regulatory inquiries, and consolidated class litigation later settled for $45 million covering both the 2023 and a prior 2019 breach. MGM's 2023 Form 10-K carries a dedicated Item 1C cybersecurity disclosure and treats the "Cybersecurity Issue" as a continuing risk factor.

How the Attack Worked

Kill-chain (awareness altitude, no reusable tradecraft): (1) Recon: the crew is known for profiling target-company staff using LinkedIn, other business-to-business sites, and commercial data to identify a real employee and enough personal detail to sound convincing. (2) Contact: an attacker phoned MGM's IT help desk by voice (vishing) posing as that employee. (3) Rapport/pretext: using the harvested personal details to pass identity checks and sound like a routine internal user, the caller requested help regaining access. (4) Exploitation: the help desk performed an MFA/credential reset for the impersonated account, which handed the attacker a valid login and effectively bypassed multi-factor authentication; access was then escalated to administrative control of the Okta identity provider and Azure tenant, enabling lateral movement. (5) Payout: access was monetized through data theft for extortion and deployment of ALPHV/BlackCat ransomware against virtualization infrastructure; MGM refused to pay and absorbed an outage it valued near $100 million.

The core lesson: strong MFA provides little protection if a help desk can be talked into resetting it for whoever calls, and identity providers like Okta are crown-jewel systems that deserve controls on par with domain controllers.

The Lure & the Tell

Pretext: a caller impersonating a genuine MGM employee (identified via LinkedIn) asking the IT help desk for account/MFA assistance, made credible by personal details scraped from public sources. Red flags visible to defenders: an access/MFA-reset request arriving purely by phone with no independent, out-of-band confirmation of the caller's identity; a help-desk workflow that let a single agent reset MFA on a privileged account without call-back verification or manager approval; and reliance on identity data (name, role, personal facts) that is trivially harvested from LinkedIn and data leaks, making "knowledge-based" verification effectively worthless.

Outcome

Roughly ten days of major operational disruption across MGM's U.S. properties; ~100 ESXi hypervisors hit with ransomware; PII exposure affecting customers who transacted before March 2019. MGM refused to pay ransom, took systems offline, and reported a ~$100M EBITDAR hit plus under $10M in one-time costs, with insurance expected to cover most of it.

Follow-on consequences: FTC investigation (challenged by MGM), state regulatory inquiries, and a $45M class-action settlement covering the 2019 and 2023 breaches. The rival Caesars incident, tied to the same actor, reportedly involved a paid ransom of about $15M.

Financial impact: Moody's characterized the breach as credit-negative for MGM Resorts given the scale of the operational disruption. Source: Reuters, citing Moody's.

Why It Matters

MGM is the canonical, board-level example that human-directed help-desk social engineering is a tier-one initial-access vector: attackers defeated MGM's technical controls not by breaking them but by persuading a person with reset authority to bypass them. It shows that MFA and SSO consolidate risk: compromise the identity provider and you own the enterprise, and a ten-minute phone call can produce a nine-figure business impact.

It also demonstrates how public professional profiles and leaked data make employee impersonation cheap and convincing.

Defenses

Remove the help desk's ability to unilaterally reset MFA or credentials for privileged/high-value accounts; require strong out-of-band identity verification for any access reset (call-back to a known number, manager approval, in-person or video verification, or one-time codes delivered through a separate trusted channel). Do not rely on knowledge-based checks that can be scraped from LinkedIn or bought from data brokers.

Deploy phishing-resistant MFA (FIDO2/WebAuthn or PKI) that resists SIM-swap and push-fatigue. Treat identity providers (Okta) and cloud tenants (Azure) as crown-jewel infrastructure with tight admin controls, hardware-backed admin MFA, and anomaly monitoring for privilege escalation, new federation/identity-provider additions, and unusual admin logins.

Train help-desk staff specifically against vishing pretexts, and maintain tested offline backups and rehearsed incident-response and containment playbooks.