One Phone Call, $100 Million: The MGM Resorts Help Desk Attack
In 2023 attackers phoned MGM's IT help desk, posed as an employee, and walked away with control of its systems. How it happened, what it cost, and the lesson for any organisation.
MGM Resorts had passwords, multi factor authentication and an IT team. In September 2023 attackers got past all of it with a phone call.
What happened
Using details about an employee that were reportedly available on LinkedIn, the attackers called MGM's IT help desk and pretended to be that employee. They persuaded the help desk to reset the account's password and its multi factor authentication.
With a working account and their own second factor attached, they were inside. From there they gained control of MGM's IT environment and deployed ransomware. The attack was attributed to the group known as Scattered Spider, using ALPHV, also called BlackCat, ransomware.
The impact
The disruption lasted more than a week:
- Guests were locked out of their rooms and reservation systems stopped working.
- Website and mobile booking went offline.
- Some gamblers were handed paper IOUs while systems were down.
- Hotel occupancy that September was 88 percent, compared with 93 percent a year earlier.
In a filing with the US Securities and Exchange Commission, MGM said the attack would reduce its EBITDAR by about 100 million dollars, plus about 10 million dollars in one time costs. MGM did not pay a ransom.
Customer data was also taken, including names, contact details, dates of birth, driver's license numbers and, for some customers, Social Security or passport numbers.
Why it worked
The weakest login was the recovery process. Multi factor authentication protects the front door. A help desk that resets it on request turns the back door into a bypass.
The help desk was doing its job. Help desks exist to unlock locked out staff quickly. Attackers exploit that helpfulness with confidence, urgency and a few personal details.
Public information was enough. An employee's name, role and workplace, the kind of thing many people share on professional networks, helped the impersonation sound real.
The lessons
1. Treat account recovery as security
Ask a simple question: what does someone need to know or have to get a password and second factor reset? If the answer is a name and some public details, the recovery process is weaker than the login.
2. Verify identity before any reset
Strong options include a video call with an ID check, a callback to a number already on file, approval from the person's manager, or an in person visit. Answers to questions anyone could research online are not verification.
3. Protect high value accounts more
Accounts with administrator access should have the strictest reset rules, and ideally phishing resistant sign in such as passkeys or hardware security keys.
4. Watch for resets
A password and second factor reset followed by unusual activity is a strong warning sign. Alerting on that combination gives defenders a chance to act early.
What this means for you
The same trick works on individuals. Scammers call phone carriers to move a victim's number to a new SIM card, then use it to receive login codes. Most carriers let you add a PIN or extra verification for account changes. Set one up, and prefer an authenticator app or passkey over text message codes for your important accounts.
Frequently asked questions
How did the attackers get into MGM Resorts?
Using public details reportedly found on LinkedIn, they posed as an MGM employee, called the IT help desk, and persuaded staff to reset that account's password and multi factor authentication.
What did the attack cost MGM?
MGM said in a filing with the US Securities and Exchange Commission that the attack would reduce its EBITDAR by about 100 million dollars, plus around 10 million dollars in one time costs.
Did MGM pay a ransom?
No. MGM did not pay a ransom.
What customer data was affected?
Names, contact details, gender and dates of birth, driver's license numbers, and for some customers Social Security or passport numbers.
Who was behind it?
The attack was attributed to the group known as Scattered Spider, which used ALPHV, also called BlackCat, ransomware.
What is the main lesson?
Account recovery is part of your security. If a phone call can reset someone's password and multi factor authentication, an attacker only has to sound convincing. Identity checks for resets must be as strong as the login itself.