How did the MGM Resorts cyberattack start?

The 2023 MGM Resorts attack was widely reported to begin with a phone call that talked the IT help desk into resetting access. MGM reported roughly $100M in impact to quarterly earnings.

← All threat briefings

Hospitality · USA · 4 min read

The 10-minute phone call that cost MGM Resorts $100 million

$100M

hit to quarterly earnings

In September 2023, MGM Resorts lost control of systems across its hotels and casinos. Room keys, slot machines and payments failed for about ten days.

The bill

About $100 million hit to quarterly earnings, per MGM's own filing.
Around $10 million more in one-off technology, legal and advisory costs.
Customer personal data taken, followed by lawsuits.

How it started

Attackers reportedly found an employee on LinkedIn, then phoned the IT help desk pretending to be them. A reset later, they were inside.

A $100 million loss against a training cost of a few dollars per employee is not a close decision.

What to do this week

Require call-back verification before any password or MFA reset.
Remove personal details staff share publicly that help impersonators.
Run a vishing drill against your own help desk.

Sources

Next breakdown

Supermarket freezers hacked: tens of millions of euros of food thrown away →