MGM Resorts International suffered a $100M cyberattack in 2023; slot machines went dark, room keys failed, booking systems crashed. Here's exactly how Scattered Spider did it.
Marco Cavani
Cybersecurity Analyst
MGM Resorts International is a Nevada-based gaming and hospitality company listed on the S&P 500, operating globally. In the previous year, MGM generated approximately $16.16 billion in global revenue, representing a substantial growth curve over the past 15 years (Statista Research Department, 2024).
The scale of the enterprise and the size of its attacking surface made MGM a prime target for Scattered Spider (UNC3944), who in 2023 breached through the company network.
Scattered Spider gathered publicly accessible information on LinkedIn about MGM personnel, targeting employees with high Okta privileges.
The adversary engaged in a vishing campaign, impersonating personnel to lure IT help desk employees into resetting the MFA of targeted accounts.
Scattered Spider gained access to Okta and configured a new Identity Provider (IdP) in MGM’s Okta Tenant, securing permanent access within the company system. The new IdP granted highly privileged access to MGM’s Azure environment.
MGM’s cybersecurity team detected the malicious activity and shut down the Okta Tenant. However, it was not enough to prevent the group from:
(Mandiant, 2023)
MGM systems were shut down to prevent further intrusion. While this protected customers’ bank details from leaking, the operational impact was severe:
On September 12th, 2023, MGM announced the breach in a K-8 SEC filing:
Estimated losses of $100 million in disruption costs, plus an additional $10 million to adjust their cybersecurity posture and restore systems. MGM did not pay the ransom (McMillan & Sayre, 2023).
For a comprehensive deep-dive into Scattered Spider’s tactics, techniques, and procedures, including their attack on Caesars Entertainment, read the full intelligence report:
→ Scattered Spider: The Casino Hacks Full Report
Written by
Marco Cavani
Cybersecurity analyst and IT governance professional. Author of digital reports on threat intelligence, critical infrastructure security, and IT audit frameworks.
Nearly 1.9 million phishing attacks in a single year, $4.5M average breach recovery cost, and seniors losing $3.4B. The data on phishing in 2024 is staggering. Here's what organisations must do.
How Generative Adversarial Networks are being weaponised by cybercriminals, why regulators are scrambling to catch up, and what individuals and organisations can do to protect themselves.
In 2022, the Lapsus$ group compromised Microsoft, Okta, Samsung, and Nvidia by spamming push MFA notifications until tired users approved. Cloudflare was also targeted. Their FIDO2 hardware keys made the attack irrelevant. Authentication is the control that decides which outcome you get.
Get the latest cybersecurity reports, threat intelligence, and IT governance insights delivered straight to your inbox. No spam. Unsubscribe any time.
No spam. Unsubscribe at any time.
The RACM ITGC SaaS platform helps audit professionals manage IT General Controls assessments, from risk and control mapping to workpaper generation and evidence tracking.
