How did the MGM and Caesars attacks start?

With social engineering against IT service desks. Reporting on both incidents describes attackers identifying employees through public professional profiles, then telephoning the service desk while impersonating them and requesting password or multi-factor authentication resets. Once a reset was granted, the attacker enrolled their own factor and had a working account.

Why is the help desk such an effective target?

Because it exists to restore access for people who have lost it, which means it is authorised to undo authentication controls. Staff are measured on how quickly they resolve tickets, trained to be helpful, and often working from a script that accepts weak identity checks such as employee number, date of birth or manager's name, all of which are discoverable. A successful call bypasses every authentication factor the organisation has deployed.

What did the attacks cost?

Caesars was reported to have paid roughly 15 million dollars, and disclosed that data including loyalty programme information had been taken. MGM refused to pay and disclosed an expected negative impact of around 100 million dollars for the quarter, with days of visible disruption to hotel check-in, room keys, slot machines and reservations.

Was paying the right decision?

The comparison does not settle that, and it does clarify what payment buys. Caesars paid and still had data stolen, with only a promise of deletion from people whose business depends on holding data hostage. MGM refused, absorbed substantial operational disruption, and also had data stolen. Payment addressed disruption rather than exposure, which is the general shape: extortion payments buy time and a promise, and they never un-steal data.

The activity has been widely associated with a loosely organised, largely English-speaking crew tracked under several names, working with a ransomware-as-a-service operation for the encryption stage. Several individuals were subsequently charged in the United States. Attribution is an investigative claim; what matters defensively is that the technique requires social skill and a telephone rather than advanced tooling.

What is the single fix?

Strong identity verification before any credential or multi-factor reset, with a materially harder path for privileged accounts: a callback to a number of record, a manager confirmation through a separate channel, a video check against an identity record, or in-person verification. And an explicit policy that makes refusing an unverified request the safe choice for the person on the phone.

MGM and Caesars: One Crew, Two Help Desks, Two Answers

In September 2023 two of the largest casino operators in Las Vegas were attacked within days of each other by people using the same technique: a telephone call to the IT help desk.

No exploit. No malware on the way in. Someone looked up an employee, called the service desk pretending to be them, and asked for their access to be restored.

The two companies then made opposite decisions about payment, which is why they are worth writing about together. The comparison does not produce a rule about whether to pay, and it does show precisely what each choice bought.

Timeline

Date	Event
Early September 2023	Social engineering against Caesars' IT support, reportedly via an outsourced provider
7 September 2023	Caesars discloses in a subsequent filing that it identified the activity around this period
10 September 2023	MGM begins experiencing outages. Systems are taken offline in response
11 to 20 September 2023	Visible disruption at MGM properties: check-in, digital room keys, slot machines, reservations, payment
14 September 2023	Caesars files an 8-K disclosing the incident and data theft
5 October 2023	MGM files an 8-K describing an expected negative impact of around 100 million dollars for the quarter

The technique

Reconnaissance from public sources. Professional networking profiles supply a name, a job title, a location, a manager, a tenure and often a photograph. That is enough to sound like a specific employee, in a specific team, with a specific reason for calling.

A phone call to the service desk. The attacker impersonates the employee and reports being locked out. The desk applies its verification procedure, which typically asks for information that appears on those same public profiles or is otherwise obtainable, and then resets the password or the multi-factor enrolment.

Enrolment of the attacker's factor. With the reset granted, the attacker registers their own device. The account is now theirs, with a legitimate credential and a legitimate factor.

Escalation toward identity infrastructure. The intrusions moved toward the systems that manage identity across the estate, because compromising those converts one account into many. This is the same reasoning set out in The Okta Breaches: the identity layer is the shortcut past every other access control.

Data theft, then encryption. Data was exfiltrated, and ransomware from an established operation was deployed at MGM.

Two things about the callers are worth stating, because they break common training.

They were fluent English speakers with cultural familiarity, so the standard advice about unusual phrasing or unfamiliar accents did nothing. And they were persistent and calm, willing to call repeatedly and to escalate to a different agent if the first refused.

Why the help desk is the weak point

The service desk exists to restore access for people who have genuinely lost it. That is a legitimate and necessary function, and it means the desk is authorised to undo authentication controls.

Consider what an organisation spends on authentication: hardware keys, conditional access policies, device compliance, session controls. Then consider that a phone call can result in a new factor being enrolled on an attacker's device. Every one of those controls is bypassed, not defeated.

The pressures are structural:

Speed is the metric. Agents are measured on resolution time and customer satisfaction. Slowing down to verify is penalised by the scoreboard.
The caller sounds distressed and important. Refusing a genuine executive who cannot access their email has career consequences that refusing an attacker does not appear to have.
The verification questions are weak. Employee number, date of birth, manager's name, office location. All discoverable.
Outsourced desks are further from the culture and often working from a stricter script with less discretion to refuse.

The two answers on payment

Caesars was reported to have paid roughly 15 million dollars, and the company disclosed that data including loyalty programme information had been taken. Reporting indicated a faster return to normal operations.

MGM refused. It disclosed an expected quarterly impact of around 100 million dollars and experienced days of visible disruption across its properties, with staff reverting to manual processes at check-in and on the gaming floor.

The useful reading is what each choice bought.

Payment addressed disruption, not exposure. Caesars still had data stolen. What the money bought was a promise of deletion from a criminal operation and, in practice, a faster operational recovery.

Refusal cost operations and did not increase exposure. MGM's data was gone regardless. What refusal cost was time and revenue; what it avoided was funding the operation and depending on a criminal's promise.

Neither is a template. The decision depends on whether backups can restore service in an acceptable time, what the legal and regulatory position is, whether sanctions considerations apply to the recipient, and how the organisation weighs funding future attacks. What both cases establish is that payment does not un-steal data, so the confidentiality consequences are identical either way, which is the point made in The MOVEit Breach about extortion without encryption.

That decision should be made in advance, in daylight, with legal and executive input, and written down. Making it during an outage at three in the morning is how organisations end up paying for something payment cannot deliver.

What to change on Monday

The controls here are procedural rather than technical, and they are cheap.

Verification proportional to what is being reset. Restoring access to a shared printer queue is not the same as re-enrolling multi-factor authentication for an administrator. Tier the procedure.

A callback to the number of record, held in the HR system rather than supplied by the caller.

Manager confirmation through a separate channel for privileged accounts, or in-person or video verification against an identity record.

A cooling-off period for high-risk resets, which removes the urgency that social engineering depends on.

Alerting on the reset itself. A multi-factor re-enrolment on a privileged account is a security event, and it should reach a monitoring queue rather than only a ticket, per What Is a SIEM.

Explicit permission to refuse. State in policy, and repeat in training, that no employee will ever be penalised for declining an unverified reset request, and that executives are subject to the same procedure. Without that, the incentives point the other way and the procedure loses.

Test it. Include help desk social engineering in red team scope. Most organisations have never tried to call their own service desk as an attacker would, and the result is usually instructive.

Social Engineering Playbook covers the persuasion mechanics being applied.

What generalises

The help desk is an authentication bypass with a phone number. Its procedure is a security control and deserves the attention one.
Public professional profiles are reconnaissance. That is not a reason to delete them, and it is a reason to assume the attacker knows the org chart.
Identity infrastructure is the objective, because it converts one account into all of them.
Decide the payment question before the incident, since payment addresses disruption and never exposure.
A visible consumer-facing outage becomes a public story quickly, so communications planning belongs alongside technical response.

The verdict

Two of the largest hospitality operators in the world were taken down by phone calls. The technique requires social confidence and an org chart, and it defeats an authentication stack costing millions because the help desk is authorised to undo it.

The fix is a verification procedure with teeth and a culture where refusing an unverified request is safe. That is a policy change and a training change, and it is the highest-return security work available to most organisations right now.