On 11 September 2023, guests at MGM’s Las Vegas properties found the slot machines dark, the digital room keys dead, the reservation site down and the front desks issuing physical keys by hand. It stayed like that, in varying degrees, for about ten days. MGM later told the SEC the incident knocked roughly $100 million off adjusted property earnings for its Strip and regional resorts.
The entry point was a phone call to the IT help desk that lasted around ten minutes.
The phone call
The group behind it — tracked as Scattered Spider, an affiliate of the BlackCat/ALPHV ransomware operation — does not start with an exploit. It starts with a name. Per CISA and the FBI’s later advisory, the group’s signature move is to pose as a company employee (or as IT staff) on a phone call or text and talk a help desk into handing over access: resetting a password, enrolling a new MFA device, reading out a one-time code.
In MGM’s case, Tenable’s reconstruction is that the attackers found an employee on LinkedIn, called the help desk impersonating that person, and on the same call got the MFA reset that turned a set of stolen credentials into a working login — one that happened to carry Okta super administrator privileges.
That is the whole initial-access story. No malware, no phishing link, no unpatched CVE. A convincing voice and a help desk with the authority to reset MFA but no reliable way to verify who was actually on the line.
From one account to the whole company
Super admin in Okta is not “an account.” Okta is the identity provider — the thing every other application trusts to say who you are. With that console, the attackers did three things in sequence, per Tenable and Okta’s own account of the campaign:
- Weakened MFA policy — made it optional or turned off requirements, so their own access wouldn’t trip alarms and wouldn’t drop.
- Added a second, attacker-controlled identity provider as an “impersonation app” via inbound federation (Okta’s Org2Org). Once MGM’s Okta tenant would accept assertions from an IdP the attackers ran, they could authenticate as any user in the company without knowing a single additional password.
- Harvested plaintext credentials through the directory-sync path — Tenable describes sniffing passwords via the sync agent for accounts whose hashes couldn’t be cracked from a domain-controller dump.
From there they escalated into Global Administrator on MGM’s Azure/Entra tenant. At that point the attackers controlled both the on-prem identity plane and the cloud one. There was no “inside” left to break into.
The part that actually hurt
With domain-wide control, Scattered Spider deployed ALPHV ransomware and encrypted more than 100 ESXi hypervisors — the virtualization hosts that run large fractions of the estate as guest VMs. Encrypting a hundred ESXi hosts is not a hundred separate incidents; it is one action that takes down whatever those hosts were running. Reservation systems, digital keys, slot floor systems, points-of-sale and websites all went at once.
MGM says it did not pay. Recovery meant rebuilding and restoring from backup across the affected systems, which is why “back to normal” took about ten days rather than ten hours, with some services (mobile check-in, digital keys) degraded for longer.
What it cost, on the record
From MGM’s 8-K:
- A negative impact of about $100 million to third-quarter Adjusted Property EBITDAR for the Las Vegas Strip and regional operations combined, most of it concentrated in September.
- Less than $10 million in one-time costs — outside technology consulting, legal fees, other advisors — with the company expecting cyber insurance to cover the response.
- Personal data stolen for a set of customers who transacted with MGM before March 2019: name, contact details, gender, date of birth and driver’s licence numbers, and for a smaller group, Social Security and passport numbers. MGM stated bank-account and card data were not taken.
The lopsided ratio there — $100M of lost business against <$10M of direct response cost — is the point. For an operator whose revenue is gated by whether the floor is running, downtime is the damage.
Caesars, three weeks earlier
The same group hit Caesars Entertainment in late August 2023, getting in through an outsourced IT support vendor rather than an internal help desk. Caesars made the opposite call: it paid roughly $15 million, reportedly negotiated down from an initial ~$30 million demand, in exchange for a promise to delete stolen loyalty-program data. Caesars disclosed the incident in its own SEC filing days after the MGM story broke, and avoided a visible operational outage.
Two very similar breaches, a few weeks apart, same threat actor, two different decisions — and neither company came out of it clean. Caesars still had the data stolen and still had to disclose; there is no evidence the payment did anything except avoid a public dump. MGM avoided funding the attackers and ate the outage.
The lessons that generalise
The help desk is part of the security perimeter. Any process that can reset MFA or a password on a phone request is an authentication bypass with a human in the loop. It needs the same scrutiny as a login page: callback verification, manager approval for privileged accounts, no MFA resets on first contact.
Your identity provider is the crown jewel, not a utility. Super-admin in Okta or Global Admin in Entra is equivalent to domain admin everywhere at once. Those roles should be few, hardware-key protected, alerted on every use, and — critically — changes to federation and IdP trust should page someone. Adding an external identity provider is not routine configuration.
ESXi is a single blast radius. Consolidating hundreds of workloads onto a shared hypervisor layer is efficient until someone with domain rights reaches the hypervisors. Management-plane isolation, separate credentials for vCenter/ESXi, MFA on that plane, and genuinely offline backups are what stand between “an incident” and “the casino runs on paper for a week.”
“Do we pay?” is the wrong question to be answering in week one. Both companies were deciding ransom strategy mid-crisis. The decisions that actually mattered — help-desk verification, IdP protection, backup isolation — were all available to make a year earlier, for far less than $15 million.
Tech-Bee is an independent technology publication. This piece is drawn from MGM’s and Caesars’ SEC filings, the CISA/FBI advisory on Scattered Spider, Tenable’s technical analysis, and contemporaneous reporting. Attribution and the internal attack chain reflect those public accounts.