how it happened
- whoattackersfound an employee online
- the gaphelp desk resetpassword and MFA (reported)
- thenidentity and cloudransomware
- the result~$100M quarter hitslots, keys, bookings down
what everyone assumed
Help desks exist to remove friction for legitimate users, and a confident caller with the right details reads as legitimate. The assumption is that identity verification by phone is good enough, and that resetting access for a stuck employee is routine and low-risk.
what happened
According to the attackers and press reports, in roughly ten minutes the help desk reset credentials and MFA for the impersonated account, handing the attacker administrative reach into the identity and cloud platforms. Ransomware followed. By those accounts, the whole intrusion began with a phone call and a reset.
step by step
- a caller impersonates an employeePer the attackers and press reports.
- the help desk resets password and MFA in ten minutesAdmin reach into identity and cloud platforms follows.the assumption breaks here
- ransomwareSlot machines, room keys and reservations disrupted.
- September 2023about $100 million impactMGM's filing does not describe the entry point.
how it surfaced
In September 2023 MGM disclosed disruption to slot machines, room keys, and reservations across properties, and later reported an impact near $100 million to the quarter. By the attackers’ own account and press reports, the entry point was a help-desk social-engineering call; MGM’s filing does not describe it.
The help desk is an identity control, and a confident caller is an attack against it.
Verification that relies on facts an attacker can learn online is verification an attacker can pass.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAn attacker calls as an admin and gets the reset in minutes.what it costs youWithin hours they control your systems, and customers cannot use your services.
- or it goes like thisit happenedClorox and Cognizant, 2023howAn outsourced desk resets an account three times without checking the caller.what leavesa fully working employee loginwho ends up with itan intruder who looks legitimate everywhere
- or it goes like thisit happenedCaesars Entertainment, 2023howThe support vendor itself is talked into giving access.what leavesthe customer databasewho ends up with itan extortion group
sources
your turn
what you can do about it
this week
Ask your help desk how it proves a caller is who they claim before a reset.
Your help desk resets access and MFA for locked-out employees every week, verifying them with details that are often findable online. The process that helped your staff is the process MGM's attacker used. How your desk proves a caller is who they claim is the question worth asking before someone else asks it for you.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →