This is an older essay or practical note. Its reference date is retained from the original entry; use current vendor guidance for product versions and security updates.
It sounded like a scene from Ocean's Eleven, but there were no lasers or acrobats. Just a phone call. The MGM Resorts breach of 2023 cost the casino giant $100 million and exposed the uncomfortable truth: You can't patch a human being.
Executive Summary
In September 2023, MGM Resorts International, operators of the Bellagio, Aria, and Cosmopolitan in Las Vegas, suffered a devastating cyberattack. Slot machines displayed error messages. Hotel room keys stopped working. Guests waited in line for hours to check in manually with pen and paper.
The attackers, a group known as Scattered Spider (an affiliate of the BlackCat/ALPHV ransomware gang), did not use a complex zero-day exploit. They found an MGM employee's information on LinkedIn, called the IT Service Desk, and impersonated them.
The Vishing (Voice Phishing) Playbook
Social Engineering is the art of manipulating people into performing actions or divulging confidential information. In this case, the attackers used a technique called Vishing.
The "script" likely went something like this:
"Hi, this is [Employee Name]. I'm locked out of my Okta account and I have a client presentation in 10 minutes. I lost my phone so I can't do the push notification. Can you reset my MFA to this new number?"
The helpdesk agent, wanting to be helpful (and likely lacking strict identity verification protocols for voice calls), complied. With the MFA reset, the attackers logged in, gained persistence, and moved laterally to the domain controller.
The Caesars Comparison: To Pay or Not to Pay?
Weeks prior to the MGM attack, rival casino giant Caesars Entertainment was hit by the same group. Caesars chose to pay the ransom—reported to be around $15 million USD. In exchange, they received a promise that the data would not be leaked and their systems were kept online.
MGM, in contrast, refused to pay. They took the "burn it down" approach, shutting down their own systems to contain the spread. This resulted in significant operational chaos but denied the attackers their payout. This tale of two casinos highlights the central ethical and financial dilemma of modern incident response.
Identity Provider (IdP) Manipulation
Once inside, scattered Spider targeted the Identity Provider (Okta). They established persistence by creating "Federated Identity" trusts. This meant that even if MGM reset every password in the company, the attackers could still generate valid login tokens because they controlled a "trusted" external identity server.
The Fallout
MGM reported a $100 million hit to its quarterly earnings. This implies that for a company of MGM's size, the cost of downtime far exceeds the cost of the ransom. However, paying the ransom funds future attacks and does not guarantee data safety.
Defending Against Vishing
The helpdesk is the new perimeter. Defending it requires:
- MFA for Resets: Agents should not be able to reset MFA without a secondary verification (e.g., a manager's approval).
- Visual Verification: Require a quick Zoom call where the employee shows their ID badge next to their face.
- FIDO2 Hardware Keys: YubiKeys are phishing-resistant. Even if the attacker tricks the user into visiting a fake login page, the hardware key will refuse to authenticate.
The MGM breach proved that while we spend millions on firewalls and EDR, the most dangerous vulnerability is the helpful employee on the other end of the phone.