MGM Resorts: one phone call to the help desk

The story

On September 11, 2023, MGM Resorts, which runs many of the largest hotels and casinos in Las Vegas, found attackers inside its systems. Over the following days, slot machines stopped working, digital room keys failed, ATMs went down and guests waited in long lines to check in by hand. Some systems were out for about ten days.

The attackers were a group known as Scattered Spider, made up largely of young English-speaking people in the US and UK. They had looked up an MGM employee on LinkedIn, then called the company’s IT help desk pretending to be that person. The help desk gave them access. From there, they worked with a ransomware group to encrypt systems.

Around the same time, the group hit Caesars Entertainment with similar methods. Caesars reportedly paid a ransom. MGM did not.

Why it mattered

A company with a large security budget was brought down for days by a single phone call. Its share price fell, and a major credit rating agency warned that its heavy reliance on computer systems was a risk. US government agencies later published warnings about the group’s methods, and checking who is really on the line before resetting an account became standard advice for help desks.

The lesson today

The weak point was a phone call. Help desks exist to help people who are locked out, and attackers know it. Any business that resets passwords or sign-in methods over the phone needs a way to prove the caller is who they say they are, such as calling them back on a number already on file, or confirming with their manager.