MGM Resorts 2023 Breach: A $100M Lesson in Help Desk Security and Vishing-Based Identity Attacks

The September 2023 ransomware attack on MGM Resorts International is the most financially damaging and strategically instructive cyberattack against a US enterprise in recent history. A single 10-minute phone call to MGM's IT help desk — preceded by a LinkedIn search — triggered a chain of events that cost the company more than $100 million, took slot machines offline for days, locked hotel room keys, and disrupted reservations across 30+ properties. The perpetrators were members of Scattered Spider, a loosely organized group of English-speaking threat actors ranging in age from 19 to 24. They used no zero-day exploits. They deployed no custom malware. They made a phone call.

The MGM breach is important not because it is unique but because it is representative — of the social engineering techniques now being used at scale against mid-market enterprises, of the inadequacy of MFA as a complete identity control, and of the catastrophic financial consequences that follow when social engineering succeeds against an organization without compensating controls.

What Happened: The Complete Attack Timeline

Day 1: The LinkedIn Research and the Phone Call

Scattered Spider actors identified an MGM IT administrator on LinkedIn, gathering enough personal information — name, employer, role, likely contact details accessible through breach databases — to construct a convincing impersonation. They called MGM's corporate help desk, impersonated the administrator, claimed they were locked out of their MFA device while traveling, and requested an MFA reset. The help desk complied. The attackers now had authenticated access to MGM's identity infrastructure.

Days 1–4: Lateral Movement and Reconnaissance

With authenticated access to MGM's Okta environment, the attackers conducted reconnaissance of the broader Microsoft 365 and internal network architecture. They identified administrative accounts, mapped the Active Directory structure, located backup infrastructure, and exfiltrated sensitive data. The attacker group also conducted extensive reconnaissance of MGM's on-premises infrastructure, establishing the scope of what could be encrypted for maximum operational disruption.

Day 4: The Ransomware Deployment

On Sunday September 10, 2023, the attackers deployed ALPHV/BlackCat ransomware across MGM's infrastructure. The deployment was timed for a Sunday — when security staffing is at its lowest — and targeted systems that would create maximum operational visibility: hotel management systems, slot machine infrastructure, reservation platforms, and the corporate email environment. MGM's slot machines went dark. Hotel room key systems failed. Guests could not check in digitally. Reservation systems became unavailable. The public-facing operational failure was immediate and unmistakable.

The Response and Recovery

MGM's incident response team, supported by outside counsel and cybersecurity firms, worked to contain and remediate the breach. MGM publicly confirmed it did not pay the ransom. Recovery of full systems took approximately 10 days. MGM disclosed the incident to the SEC under the new 4-day disclosure requirement, marking one of the first major tests of the SEC's cybersecurity disclosure rules.

The Attack Vector: Social Engineering Against Identity Infrastructure

The MGM attack followed a technique that Scattered Spider had refined across dozens of targets: using publicly available personal information to pass identity verification at corporate help desks, obtaining MFA resets that provide authenticated access to SSO platforms like Okta, and using that SSO access to pivot through connected enterprise applications.

The specific vulnerability exploited was not a software flaw. It was a procedural gap: MGM's help desk identity verification procedure relied on knowledge factors — information that an attacker with access to breach databases and LinkedIn could easily assemble. Date of birth, employee ID, and the last four digits of a Social Security number are not secrets in 2026. They are available in bulk breach databases for the majority of the US adult population.

Once Okta access was established, the attack proceeded through standard enterprise penetration techniques. Okta's SSO integration with other enterprise platforms meant that a compromised Okta administrator account provided access to connected applications. Lateral movement through the MGM network used the elevated permissions of the compromised administrator account to access additional systems, exfiltrate data, and eventually deploy ransomware across the estate.

The ALPHV/BlackCat ransomware group claimed the attack and published details through their data leak site, including claims about the scope of data exfiltrated. MGM's legal response included DMCA notices to the leak site, an unusual defensive measure that drew attention to the legal dimensions of breach extortion.

Private Equity Implications

The MGM breach has direct implications for PE sponsors with hospitality, entertainment, gaming, and consumer-facing portfolio companies — and for any portfolio company that runs corporate help desks with conventional identity verification procedures.

The help desk identity verification gap that Scattered Spider exploited is not specific to MGM. It exists in the majority of mid-market organizations that have not specifically redesigned their verification procedures to exclude knowledge factors available in breach databases. A PE operating partner who calls the IT help desk of any portfolio company and attempts the Scattered Spider social engineering sequence is likely to find the same vulnerability.

Post-close security integration programs that do not include help desk security assessment and remediation are missing the highest-impact initial access vector against the current threat landscape. The MGM breach is not an anomaly — it is a documented, repeatable technique that Scattered Spider applied across MGM, Caesars, Okta, Twilio, and dozens of other organizations in 2022–2023, and that successor groups are actively using in 2026.