How MGM Got Hacked in 10 Minutes (and How to Prevent It)
MGM Resorts was breached in September 2023 when an attacker found an employee’s name on LinkedIn, called MGM’s IT help desk pretending to be that employee, and convinced an agent to restore access to the account. The call reportedly took about 10 minutes. The ransomware attack that followed cost MGM an estimated $100 million.
Key takeaways
- The attack needed no technical skill: one public LinkedIn profile and one phone call opened MGM’s systems.
- The help desk agent had no reliable way to verify the caller’s identity, so they relied on trust.
- This is a tooling gap, not a training or staffing failure.
- Help desks need a defined way to verify the human on the line before resetting passwords or MFA.
- Two options close the gap: a manual investigative team or automated identity verification.
“A company valued at $33,900,000,000 was defeated by a 10-minute conversation”
— vx-underground, a malware archive
How did hackers breach MGM Resorts?
They impersonated an employee on a call to the IT help desk. On September 11, 2023, MGM reported a “cybersecurity issue.” The ransomware group ALPHV, also known as BlackCat, claimed responsibility. Later reporting attributed the intrusion to Scattered Spider, a group working with ALPHV.
The attack took three steps:
- Find an employee on LinkedIn. A basic search produced the name of an MGM employee. Other details from public profiles can help, but usually aren’t needed.
- Call the help desk. The attacker claimed to be that employee, said they were locked out of their accounts, and implied they urgently needed to get back to work. The agent had no backup method to verify who was calling, so they restored access.
- Take control. With a working account, the attackers moved through MGM’s systems and deployed ransomware.
What did the MGM attack disrupt, and what did it cost?
The disruption reached guests directly. Gizmodo reported delayed check-ins, slot machines showing error messages, and outages across parking systems, the company website, and online booking.
MGM later disclosed an estimated $100 million impact on its third-quarter 2023 results, plus less than $10 million in one-time costs for consulting, legal, and third-party fees. [Link: MGM’s October 2023 SEC Form 8-K]
Was the help desk agent to blame?
No. The agent did what the process allowed. MGM had no structured way to verify a caller’s identity remotely once other methods failed, so the agent fell back on trust and intuition.
This is a tooling problem, not a staffing or training problem.
Why can’t most help desks verify who’s calling?
Most help desks have nothing that confirms the human behind a request. Multi-factor authentication (MFA) stops most password attacks, but it creates a new routine request: “I lost my MFA device and can’t log in.”
The help desk usually takes the caller at their word, or attempts some manual detective work, then resets access. An attacker telling the same story sounds identical to a real employee. That is the loophole MGM’s attackers used, and it exists at nearly every company with a help desk.
The gap has widened since 2023. AI voice cloning now lets an attacker sound like the employee they’re impersonating. Gartner reports that 62% of organizations have experienced a deepfake attack. [Link: Gartner source] Mandiant’s M-Trends 2026 found that a single help desk call can lead to full domain admin access in under 40 minutes. [Link: M-Trends 2026]
How can you prevent a help desk attack like MGM’s?
Give agents a defined procedure that confirms the person on the call matches the identity they claim, before any password or MFA reset. There are two main ways to do it:
Method 1: Build an investigative team. Some organizations route lockout cases to a dedicated team that validates ID and identity details, similar to a DMV process. It works, but it’s costly and slow. Even MGM, a $33 billion company, hadn’t built one. A breach still costs more.
Method 2: Automate identity checks. Automated verification lets help desk agents confirm a caller’s identity themselves, without making a judgment call. Most tools surface signals and ask agents to interpret them. Nametag’s helpdesk verification returns a decision the agent can act on. For more on hardening this process, see Helpdesk Social Engineering: How to Prevent It.
Frequently asked questions
Who hacked MGM Resorts?
The ransomware group ALPHV (BlackCat) claimed responsibility for the September 2023 attack. Reporting attributed the initial intrusion to Scattered Spider, a group working with ALPHV.
How much did the MGM cyberattack cost?
MGM estimated a $100 million impact on its third-quarter 2023 results, plus less than $10 million in one-time costs.
How can a help desk verify a caller’s identity?
By confirming the person matches the identity they claim before resetting a password or MFA. That means checking a government ID against the person presenting it, through an investigative team or an automated identity verification tool.
