What the MGM Resorts breach taught businesses about phone calls

About this series

The September 2023 shutdown

In September 2023, MGM Resorts, one of the largest gaming and hotel operators in the world, suffered a catastrophic security breach. The attack was not initiated by a complex software exploit. Instead, it began with a phone call to the IT help desk [2](https://www.bleepingcomputer.com/news/security/mgm-casinos-esxi-servers-allegedly-encrypted-in-ransomware-attack/).

The attackers impersonated an employee, likely using information gathered from public sources like LinkedIn. They convinced the help desk staff to reset a password and provide access to the employee's account. Once inside, the group—identified as an affiliate of the ALPHV/BlackCat Ransomware (show definition) gang—quickly escalated their access [5](https://cyberscoop.com/las-vegas-mgm-caesars-cyber-attack/).

The result was a total operational freeze. Hotel room keys stopped working. Slot machines went dark. Reservation systems were taken offline. For days, guests at some of the world's most famous hotels had to wait in long lines for manual check-ins using pen and paper [3](https://techcrunch.com/2023/09/14/mgm-cyberattack-outage-scattered-spider/).

Comparing two responses

The MGM incident occurred around the same time as a similar attack on Caesars Entertainment. However, the two companies took different paths. Caesars reportedly paid a large ransom, estimated at 5 million, to avoid data leaks and disruption [5](https://cyberscoop.com/las-vegas-mgm-caesars-cyber-attack/).

MGM chose not to pay the ransom. While this prevented funds from reaching criminal groups and potentially avoided OFAC (show definition) complications, it meant the company had to rebuild systems from backups. The disruption lasted for over a week and cost the company tens of millions of dollars in lost revenue and recovery expenses.

Why this matters for your business

Most small businesses do not have a thousand slot machines, but they do have critical systems like Practice management or job management system (show definition) software, payroll, and customer databases. The MGM breach showed that an attacker doesn't need to break your firewall if they can just ask for the keys.

If your business relies on a few key people to manage IT, a single impersonation of one of those people can lead to total ruin. The speed of the MGM collapse—from a phone call to a total shutdown in less than a day—highlights why prevention must be backed by a strong response plan.

Lessons for identity and access

To protect your business from similar tactics, you should implement strict controls around identity management. This is not just about technology; it is about policy and training.

1. Monitor for unusual patterns, such as a password reset followed immediately by a request to change the registered Multi-factor authentication (MFA) (show definition) device.
2. Require in-person or video-call verification for high-risk identity changes if the help desk does not recognize the caller's voice.
3. Separate duties so that no single person, including the business owner, can change critical security settings without a second person approving it.
4. Limit the use of Administrator access (show definition). Only use administrative accounts when performing specific maintenance tasks.

Incident readiness checklist

• A written Incident response plan (show definition) exists and includes steps for a total system outage.
• Help desk staff have a specific script for verifying callers that they cannot deviate from.
• Backups are stored separately from the main network and are tested monthly.
• Leadership has discussed the pros and cons of paying a ransom before an incident occurs.