MGM and Caesars: How a Phone Call Took Down the Las Vegas Strip

In September 2023 two of the largest U.S. casino-hotel operators were hit within days by the same largely English-speaking intrusion crew tracked as Scattered Spider (also UNC3944, Octo Tempest, Muddled Libra, 0ktapus), operating as an affiliate of the ALPHV/BlackCat ransomware-as-a-service operation. The case matters because initial access reportedly came not from a software exploit but from a phone call to an IT help desk — a reminder that identity-reset workflows are a primary attack surface. Many specifics come from press and attacker claims rather than official confirmation.

What Happened

MGM detected an intrusion on 10 September 2023 (per its SEC 8-K) and took large parts of its environment offline for roughly ten days; Caesars was compromised first, via social engineering of an outsourced IT support provider. Reported initial access to MGM: an operator identified an employee on LinkedIn and vished the help desk to reset credentials and MFA. There was no central CVE — this was social engineering. T1566 T1656 T1078

Attribution & Impact

Attribution to Scattered Spider acting with ALPHV/BlackCat is widely reported and partly self-claimed; it is not a government indictment. ALPHV encrypted MGM’s VMware ESXi hosts. Reported impact (attributed): MGM’s 8-K cited roughly a US$100M hit to quarterly adjusted earnings plus one-time expenses, expected to be covered by cyber-insurance; Caesars reportedly paid around US$15M of a ~$30M demand (Bloomberg/WSJ reporting, not officially confirmed), while MGM reportedly did not pay. Okta’s security chief said several Okta customers, including MGM and Caesars, were targeted from August 2023. See our Scattered Spider profile.

Defensive Lessons

• Harden help-desk identity verification: no credential or MFA resets on a phone call alone — require strong, out-of-band, callback- or manager-based verification beyond LinkedIn-discoverable facts.
• Treat MFA-reset and self-service-enrolment as privileged actions: log, alert, add step-up verification, and watch for new device/FIDO2 registrations.
• Extend these controls to outsourced IT and BPO help desks — the Caesars vector — and deploy phishing-resistant MFA to blunt push-fatigue and relay tactics.
• Protect virtualization management (vCenter/ESXi) with isolation, MFA and immutable backups, since ALPHV targets ESXi; rehearse identity-driven incident response with rapid session/credential revocation.