MGM Resorts International

On the evening of September 10, 2023 an operator placed a call to MGM's IT help desk. Within roughly ten minutes they had convinced help-desk staff to reset the password and MFA of an MGM employee they had identified on LinkedIn.

From that single account they pivoted through MGM's Okta identity platform into Microsoft 365 and Azure, located VMware vCenter administrator credentials, and deployed ALPHV/BlackCat ransomware against roughly 100 ESXi hypervisors. Encrypting hypervisors is a force multiplier: every virtual machine on the host goes dark at once. This is why slot machines, hotel digital keys, booking systems, restaurant POS, and the MGM Rewards app all went offline simultaneously.

The outage lasted more than 36 hours for core systems. Slot floors at the Bellagio, Aria, MGM Grand, Mandalay Bay, and other MGM properties went dark. Hotel guests waited in line while front-desk staff wrote room keys by hand. MGM's October 5, 2023 SEC 8-K filing disclosed approximately $100 million in operational impact, plus roughly $10 million in one-time remediation costs.

Customer data of approximately 10 million prior guests was reported stolen: names, dates of birth, contact info, and for a subset, driver's license and passport numbers. MGM publicly refused to pay the ransom.

The attack chain did not require a zero-day, an exploit, or any technical vulnerability in MGM's software. It required a phone, a LinkedIn account, and an IT help desk willing to reset a password for a confident caller. That is the entire playbook.