2023Social engineeringRansomwareData breach
MGM Resorts and Caesars Entertainment attacks
September 2023
In September 2023 MGM Resorts disclosed a cybersecurity issue affecting its US systems that disrupted hotel and casino operations. Caesars Entertainment disclosed in an SEC filing that suspicious activity in its network resulted from a social engineering attack on an outsourced IT support vendor, and that data including its loyalty programme database had been taken.
- Victim
- MGM Resorts International and Caesars Entertainment
- Sector
- Hospitality and gaming
- Public attribution
- The companies' SEC filings do not name the attackers. Press reports, including The Register's coverage of Bloomberg and Reuters reporting, said the attacks were allegedly carried out by the group tracked as Scattered Spider, whose help-desk social engineering methods CISA describes in advisory AA23-320A.Scattered Spider profile
Impact
MGM's SEC filing estimated a negative impact of about 100 million US dollars on adjusted property EBITDAR for the quarter, and said personal information of some customers was obtained.
Root cause
Identity processes, especially help-desk password and MFA resets, that could be manipulated by convincing phone calls.
Lessons learned: the controls it teaches
- Verify identity strongly before any help-desk credential or MFA reset.
- Use phishing-resistant MFA and alert on resets followed by privileged activity.
- Protect identity providers and virtualisation platforms as tier-0 systems.