How the MGM Resorts cyberattack happened: the help desk call that cost $100 million

The attack that knocked out slot machines and hotel room keys across MGM Resorts' Las Vegas properties in September 2023 reportedly started with a phone call to the company's own IT help desk.^[3] This case file covers what happened, how a convincing caller got past the front line, what it cost, and the one control that would have stopped it.

What happened

How they got in

A help desk exists to get stuck employees back to work quickly. That is exactly what makes it a target. According to reporting at the time, attackers contacted MGM's IT service desk while posing as an employee and talked their way into access.^[3]

A former MGM employee told reporters that staff could get a password reset by giving basic details such as their name, employee ID number and date of birth.^[3] Details like those are not secrets. They can often be pieced together from professional networking profiles, old data leaks or a bit of patient research.

Once inside, reporting said the attackers moved on to impersonating people with higher-level access and resetting the multi-factor authentication (the second login step, such as a code on a phone) tied to those accounts.^[3] The identity provider Okta had warned its customers in August 2023 about this same pattern: callers targeting help desks to get multi-factor protections reset on powerful accounts.^[3][4] In other words, the strongest lock on the door was only as strong as the person who could be talked into removing it.

What it cost

In its SEC filing, MGM estimated the attack would cut about $100 million from its third-quarter adjusted property earnings (a measure of operating profit before certain costs) across its Las Vegas Strip and regional operations. It also reported less than $10 million in one-time costs for consultants, lawyers and other advisers, and said it expected cyber insurance to cover the financial hit.^[1]

The data loss affected some customers who had done business with MGM before March 2019. Stolen details included names, contact information, gender, dates of birth and driver's license numbers, and for a limited number of people, Social Security and passport numbers. MGM said no customer passwords, bank account numbers or payment card data were taken.^[1]

In January 2025, MGM agreed to pay $45 million to settle class action lawsuits over both the 2023 attack and an earlier 2019 breach, which together exposed information on more than 37 million customers.^[5]

On July 18, 2024, UK police working with the National Crime Agency and the FBI arrested a 17-year-old in Walsall, England, in connection with the attack as part of a wider investigation into the group.^[6] This page does not name him.

The missing control

The missing control: strong identity verification at the help desk. Before resetting a password or a second login factor, the help desk needed proof that the caller really was the account owner, using something an outsider could not look up or guess.

Name, employee number and birth date are identifiers, not proof. A reset process that requires a callback to a phone number already on file, a video check against the employee's badge photo, or approval from the employee's manager would have forced the caller to control something only the real employee has. Extra checks for accounts with administrator powers would have mattered most, because those were the keys that let a single call turn into a company-wide outage.^[3]

What to do in your business

• Write down how you verify a caller. Whoever handles password resets, whether an employee or an IT contractor, should follow a written rule that does not rely on facts anyone could find online.
• Call back on a known number. When someone asks for a reset, hang up and call them back on the number already in your records, not the one they give you.
• Treat multi-factor resets as high risk. Removing someone's second login step should need a second person's approval, especially for owner and administrator accounts.
• Ask your IT provider how they do it. If you outsource support, ask them to describe their reset process in writing. Caesars' attack reportedly came through an outside IT vendor.^[3]
• Alert the real person. Set accounts to send a notice by email or text whenever a password or multi-factor setting changes, so an employee can flag a reset they never asked for.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.