How did the MGM hackers get in?

The attackers used a "vishing" (voice phishing) attack. They called an MGM IT help desk, impersonated an employee they found on LinkedIn, and convinced the technician to reset their MFA and password.

How much did the MGM ransomware attack cost?

MGM reported a $100 million hit to its EBITDAR in its Q3 2023 earnings report, plus an additional $10 million in one-time remediation and legal expenses.

Did MGM pay the ransom?

No. Unlike their competitor Caesars, MGM refused to pay the ransom demanded by the ALPHV/BlackCat group. They chose to restore their systems from backups instead.

What data was stolen in the MGM breach?

The attackers exfiltrated the personal information of approximately 10 million customers, including names, contact information, gender, date of birth, and driver’s license numbers. MGM stated that social security numbers and credit card data were not compromised for the majority of victims.

Who was responsible for the MGM attack?

The attack is attributed to "Scattered Spider" (also known as Starfraud or UNC3944), a group of young, primarily English-speaking hackers who work as affiliates for the ALPHV/BlackCat ransomware gang.

MGM Resorts Ransomware Case Study: Social Engineering at Scale

Updated May 4, 2026

In September 2023, MGM Resorts International fell victim to a devastating ransomware attack orchestrated by the threat group Scattered Spider. By leveraging sophisticated social engineering rather than technical exploits, the attackers crippled operations across the Las Vegas Strip, resulting in a $100 million negative impact on EBITDAR and a massive exposure of customer data. This case study analyzes the anatomy of the breach, the failure of identity-based security controls, and the long-term implications for corporate cyber insurance and disaster recovery.

The Anatomy of a 10-Minute Breach

The MGM Resorts breach is a landmark case in cybersecurity because it bypassed millions of dollars in perimeter defenses through a simple ten-minute phone call. The attack was executed by a subgroup of the "ALPHV/BlackCat" ransomware-as-a-service (RaaS) operation, known as Scattered Spider (also identified as UNC3944). Unlike state-sponsored actors who may spend months searching for a zero-day vulnerability, Scattered Spider relied on "vishing" (voice phishing).

The attackers identified an MGM employee via LinkedIn and then called the company’s internal IT help desk. Posing as the employee, they claimed they had lost access to their credentials and requested a password reset and a new Multi-Factor Authentication (MFA) device enrollment. Because the help desk operator did not follow a rigid identity verification protocol, the attackers were granted administrative access to the user's Okta environment.

This breach shares significant DNA with the Okta Breach Lessons: Identity Provider Risk Made Real, illustrating how the single point of failure in modern enterprises is often the identity provider (IdP) itself. Once the attackers compromised the Okta dashboard, they gained lateral movement capabilities across MGM’s entire cloud and on-premise infrastructure.

Operational Paralysis: The Cost of Interconnectivity

Once the attackers secured administrative privileges, they deployed ransomware that encrypted the company’s ESXi environment (virtualized servers). The impact was immediate and physical. Because MGM had integrated virtually all guest services into a centralized digital ecosystem, the failure of the servers resulted in:

Total Kiosk Failure: Guests could not check in or out of hotels.
Gaming Floor Shutdown: Slot machines across multiple properties displayed "Out of Service" messages.
Physical Security Risks: Digital room keys stopped functioning, requiring security personnel to manually escort thousands of guests to their rooms.
Website and App Outages: Reservations were lost, and the company had to pivot to manual, paper-based processes for several days.

Impact Category	Estimated Financial/Operational Damage
Direct Revenue Loss	Over $100 million (EBITDAR)
Remediation Costs	$10 million+ (one-time expense)
Response Duration	9-14 days of significant disruption
Detection Time	Less than 24 hours until full encryption
Data Exfiltrated	PII of ~10 million customers

Compared to other incidents like the SolarWinds Supply Chain Attack: Lessons Five Years Later, the MGM breach was not about stealth or long-term persistence; it was a smash-and-grab designed to cause maximum operational pain to force a ransom payment.

Social Engineering as the Primary Threat Vector

The MGM incident highlights a regression in cyber defense effectiveness. While organizations have spent the last decade hardening firewalls and patching software, they have neglected the human element. Scattered Spider excels at "biographical research," using social media to gather enough information about an employee to bypass Tier 1 support verification questions.

"The MGM breach serves as a stark reminder that the most sophisticated encryption in the world is useless if an attacker can simply ask for the keys over the phone."

The attackers used a technique known as "MFA Fatigue" in subsequent steps, Bombarding employees with push notifications until the victim clicked "Approve" out of frustration or confusion. This human-centric approach to hacking is faster, cheaper, and more effective than developing custom malware. It places MGM among other Major Data Breach Case Studies: Lessons Modern Businesses Must Learn where the initial entry was remarkably mundane.

Comparison: MGM vs. Caesars Entertainment

Notably, MGM was not the only target that month. Caesars Entertainment was hit by the same group just days prior. However, the two companies took diametrically opposed strategies:

Caesars' Strategy: Caesars reportedly paid a $15 million ransom to prevent the release of data and ensure operational continuity. Their systems remained largely online.
MGM's Strategy: MGM refused to pay the ransom. They chose to trigger their incident response plan, shut down systems to contain the spread, and rebuild from backups.

While MGM’s refusal to pay was lauded by the FBI and the cybersecurity community, it resulted in significantly higher short-term operational costs and stock price volatility. This creates a difficult precedent for underwriters: is it more "responsible" to pay a smaller ransom or lose $100 million in revenue?

Insurance and Legal Aftermath

MGM held a robust cyber insurance policy, which covered a significant portion of the $100 million loss. However, this incident has led to a tightening of "Social Engineering" sub-limits in mid-to-large market policies.

Key Insurance Implications:

Sub-limit Restrictions: Many insurers now cap social engineering coverage at $100,000 to $250,000, even if the total policy is $50 million.
Proof of Control: Underwriters are increasingly requiring proof of "out-of-band" verification for password resets (e.g., calling the employee back on a registered number).
Business Interruption (BI): The MGM case is a textbook example of how BI claims are calculated based on historical revenue versus post-breach reality.

In terms of scale, the MGM disruption rivals the Change Healthcare Breach Analysis: A $2.5B Healthcare Catastrophe, though the latter involved a more complex payment switch failure.

Lessons for Business Operators

To avoid the fate of MGM, security leaders must treat the IT help desk as a high-value security perimeter. The following defensive layers are now considered mandatory:

Strict Identity Verification: Implementing "visual" verification (video calls) or hardware-based tokens (YubiKeys) that cannot be phished via a phone call.
Network Segmentation: MGM’s virtualized servers were too easily accessible from the general corporate network. Hard segmentation prevents a single desk-user compromise from reaching core gaming or hotel controllers.
Immutable Backups: MGM’s ability to recover without paying the ransom was only possible because they had off-site or immutable backups that the ransomware could not delete.
Vendor Risk Management: As seen in The MOVEit Breach Case Study: Anatomy of a Supply-Chain Disaster, the interconnected nature of third-party software means your security is only as strong as the weakest link in your SaaS stack.

Key Takeaways

Human Vulnerability: Social engineering remains the most potent threat to large enterprises.
Centralization Risk: Excessive integration of guest-facing services with core IT infrastructure can lead to total operational paralysis.
Ransom Dilemma: Refusing to pay a ransom is the ethical and legal preference, but it requires a mature disaster recovery plan to survive the ensuing revenue loss.
Help Desk Security: Passwords and MFA resets are the most sensitive operations in a company and require more than just "verification questions."

Frequently asked questions

Written by

Business Indemnity Editorial

Editorial Team

Our editorial team researches AI security, cybersecurity, and cyber insurance to help modern businesses navigate digital risk.

About the editorial team →