MGM Resorts help desk social engineering and ransomware
MGM Resorts announced a cybersecurity issue on September 11, 2023 that took down hotel, casino and booking systems for days. Reporting and the attackers' own statements describe a call to MGM's IT help desk impersonating an employee found on LinkedIn, followed by control of MGM's Okta super administrator accounts and later ransomware on ESXi hosts. MGM's October 2023 8-K estimated a $100 million hit to Adjusted Property EBITDAR.
- Victim
- MGM Resorts International
- Industry
- Gaming
- Country
- United States
- Intrusion began
- Sep 2023
- First disclosed
- Sep 11, 2023
- Actor
- Scattered Spider (UNC3944), with ALPHV/BlackCat ransomware (Extortion group)
- Initial access
- Help desk social engineering
- Identity control that failed
- Identity lifecycle
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- $100 million (Estimated negative impact of about $100 million to Adjusted Property EBITDAR for September 2023, plus under $10 million of one-time costs, per MGM's October 5, 2023 8-K.)
The identity lesson
A ten-minute phone call defeated the identity stack because the help desk could reset privileged credentials without strong verification. Hardened reset procedures and phishing-resistant MFA on IdP admins are the controls that matter.
Regulatory and legal outcome
MGM agreed in January 2025 to a $45 million settlement of consolidated class actions covering this attack and a 2019 breach.
Go deeper on SWI
- Teardown: Scattered Spider and the help desk: social engineering the identity reset
- Technique: Help desk social engineering
- Product involved: Okta
Sources
- MGM Resorts Form 8-K (cybersecurity issue impact), US SEC, Oct 5, 2023
- MGM Resorts Form 8-K (September 2023), US SEC, Sep 13, 2023
- The MGM breach and the role of IdP in modern cyber attacks, Tenable, Sep 20, 2023
- MGM agrees to $45 million payment to data breach, ransomware victims, The Record, Jan 28, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Caesars Entertainment loyalty database theft via IT support vendor 2023 · Help desk social engineering
- Marks & Spencer ransomware attack via impersonation of a third-party user 2025 · Help desk social engineering
- Help desk resets of Okta super administrator MFA at multiple customers 2023 · Help desk social engineering
- Clorox intrusion after outsourced help desk reset passwords and MFA 2023 · Help desk social engineering
Cite this record
SWI Community Team. (2026). MGM Resorts help desk social engineering and ransomware. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-mgm-resorts-help-desk-ransomware/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.