What happened
In September 2023, attackers from the group known as Scattered Spider picked their target the way a salesperson would: on LinkedIn. They found an MGM Resorts employee, learned his name, his department and his role — then simply called the company's IT helpdesk and asked for help getting back into his account.
The call lasted less than ten minutes. The helpdesk agent — following the verification he was able to perform — reset the credentials. With valid access, the attackers moved into MGM's systems and eventually deployed ransomware. Slot machines went dark, check-in desks went manual, and one of the largest casino and hotel operations in the world ran on paper for days.
MGM refused to pay. Weeks earlier, Caesars Entertainment — hit by the same group — had made the opposite call and paid approximately $15 million. Caesars stayed quiet and undisrupted; MGM's refusal became nine days of very public chaos.
The open door
No software vulnerability was exploited to get in. The door was a helpdesk verification process that a stranger could pass with a name, a department and a plausible story — all of it publicly available. If identity can be "verified" with information anyone can find, the helpdesk is not a control. It is an access broker standing in front of your entire network.
The cost
MGM's incident carried an impact of roughly $100 million — operational losses across nine days of disruption, response and remediation — plus lasting damage to guest trust in a business that sells experience. Caesars' $15 million bought silence and continuity, at the price of funding the same group that came back for its competitor weeks later. Neither outcome was cheap. Only one of them was decided in advance.
What boards should do
- Set an identity-proofing protocol for every credential reset and device enrolment — documented, audited, and impossible to talk your way around. No exceptions for executives, no exceptions for charm.
- Audit what your people publish: names, roles, departments and reporting lines on LinkedIn are the attacker's reconnaissance — treat that exposure as part of your attack surface.
- Rehearse manual operations: MGM ran a casino empire on paper for nine days. Know, before the incident, which of your processes have a paper mode — and which simply stop.
- Pre-decide the ransom question at board level, with counsel involved in peacetime — not at 3 a.m. with your systems down.