MGM Resorts, 2023: a ten-minute phone call to the help desk

On the Las Vegas Strip in September 2023, guests queued at reception because digital room keys had stopped working, slot machines sat dark, and staff wrote restaurant orders on paper. The intrusion that caused it did not involve a vulnerability. It involved a phone call to the IT help desk by somebody who had read an employee's LinkedIn profile.

What happened

The attackers identified an MGM employee from public professional information, the kind of profile everyone in a corporate role maintains, and assembled enough personal and organisational detail to impersonate them convincingly. They then called MGM's internal IT support and asked for help getting back into their account.

The help desk did what help desks exist to do. It verified the caller against the information it was trained to ask for, all of which the caller had, and reset the credentials. That included the multi-factor authentication enrolment, which is the step that matters: a password reset alone is manageable, but a reset that also re-enrols the second factor hands over the whole identity.

With a valid employee identity the attackers went after the identity provider, the single system that issues access to everything else. Having a foothold there converts one employee's account into an ability to issue access at will, and it is why identity infrastructure has become the primary objective in intrusions of this kind rather than an obstacle on the way to one.

ALPHV, the ransomware operation working with them, then deployed ransomware against part of the estate. MGM responded by shutting systems down.

Ten days of paper

The operational effect was the part the public saw. Room keys stopped working. Check-in ran on manual processes. Slot machines were taken offline, reservations could not be made online, and payouts were handled by hand. Guests filmed the queues.

Almost all of that was self-inflicted, in the sense that MGM chose it. Faced with attackers holding valid identity credentials and moving through the network, the options are to shut things down and lose revenue, or to stay up and risk losing everything. MGM shut down. Recovery took roughly ten days and the company put the financial effect at around $100 million for the quarter.

Caesars Entertainment had been hit by the same crew days earlier and made the other choice, reportedly paying about $15 million. It stayed open. Both companies ended up notifying customers and facing class actions.

The timeline

1. Late August 2023: Caesars Entertainment is compromised via a social engineering attack on an outsourced IT support vendor.
2. ~8 September 2023: The help desk call to MGM takes place; the attackers obtain a credential reset.
3. 10 – 11 September 2023: MGM detects the intrusion, shuts down major systems, and files an 8-K disclosure.
4. 14 September 2023: ALPHV publishes a statement about the attack, disputing parts of the public account.
5. 20 September 2023: MGM reports that its systems are largely restored.
6. October 2023: MGM notifies customers that personal data, including driver's licence numbers and a smaller set of Social Security and passport numbers, was taken for customers who transacted before March 2019.
7. 2024 onwards: Arrests connected to Scattered Spider are announced in the US and UK; class actions consolidate.

What it changed

Help desk verification was rebuilt across entire industries. The fixes that followed are unglamorous and effective: requiring a video call with an identity document, requiring a manager to approve resets out of band, imposing a mandatory delay on MFA re-enrolment, and refusing to perform resets for privileged accounts over the phone at all.

Identity providers became the crown jewels. Once single sign-on mediates access to every application, its administrative interface is the most valuable surface in the organisation. Separate, phishing-resistant, hardware-backed authentication for those administrative roles became a standard recommendation rather than a mature-programme nicety.

Everyone learned what their own containment decision costs. Most incident response plans in 2023 had no answer to "at what point do we take the revenue-generating systems offline, and who decides". MGM made that decision in public, expensively, and a great many tabletop exercises since have been built around it.

Youth stopped being a proxy for harmlessness. A group whose members included teenagers took a $14 billion company off the internet for ten days. The skills that mattered were research and confidence on the telephone, neither of which requires resources or experience.

If you stayed at an MGM property