CyberAuditX
PHISHING AWARENESS & SIMULATION
Request a Consultation
Major Incidents

The 10-Minute Phone Call That Cost MGM $100M: Inside the Scattered Spider Vishing Attack

In September 2023, cybercrime group Scattered Spider bypassed MGM Resorts' multi-factor authentication with a simple phone call to the helpdesk. Total damages: over $100 million.

9 min read

The Las Vegas Strip Goes Dark

On September 10, 2023, guests across iconic Las Vegas luxury resorts including Bellagio, ARIA, and MGM Grand encountered digital chaos. Digital room keys failed. Slot machines shut down with blank screens. Elevators stopped responding. Check-in lines wrapped through casino floors as employees were forced to register guests on pen and paper.

The cause was not a physical intrusion or a military-grade cyber weapon. It began with a 10-minute voice phishing (vishing) call placed to the corporate IT helpdesk.

Key Incident Metric: $100,000,000 in lost revenue, plus $10,000,000 in third-party incident response and technology cleanup fees.

How the Attackers Infiltrated MGM

The breach was executed by Scattered Spider (tracked as UNC3944 / Starfraud), a loose syndicate of English-speaking threat actors skilled in modern social engineering.

Here is how the threat group breached one of the world's largest hospitality operators:

  1. LinkedIn Reconnaissance: The attackers spent days researching MGM Resorts employees on LinkedIn, identifying internal network administrators and systems engineers.
  2. The Vishing Call: Posing as an employee with a lost phone, the attacker called the internal IT Helpdesk. Using publicly available personal details (name, date of birth, employee ID patterns), they persuaded the helpdesk technician to reset their Okta Multi-Factor Authentication (MFA) credentials.
  3. Privilege Escalation: Once inside the Okta identity tenant, the attackers elevated privileges to full Okta super-administrator status.
  4. Deploying Ransomware: When MGM's security team detected the anomalous session and attempted to sever access, the attackers deployed BlackCat/ALPHV ransomware, encrypting hundreds of ESXi hypervisors.

Caesars Entertainment: The Parallel Victim

Days before MGM was crippled, the exact same syndicate targeted competitor Caesars Entertainment using identical helpdesk social engineering tactics.

Unlike MGM, Caesars chose to pay a reported $15 million ransom in exchange for a decryption key and promises that stolen customer loyalty records would not be published.

Critical Vulnerabilities Exposed

  • Helpdesk Verification Blind Spots: Helpdesks frequently rely on static identifiers (like birthday, employee name, or phone number) that can be scraped from social media or data broker databases.
  • MFA Reset Bypasses: Multi-factor authentication is only as secure as the human procedure used to reset it.
  • The Human Element: Technical firewalls and EDR agents were completely blind to an attacker walking right through the front door with legitimate credentials.

Defensive Lessons for Every Enterprise

  • Implement In-Person or Video Verification for MFA Resets: Require a manager's live visual confirmation before resetting credentials for any privileged user.
  • Simulate Vishing & Voice Social Engineering: Include phone and SMS phishing scenarios in your ongoing awareness drills alongside standard email tests.
  • Identity-First Security: Restrict helpdesk staff authority to reset administrator-level accounts without automated multi-tier executive approval.