Scattered Spider Took Down MGM and Caesars With One Phone Call

In September 2023, two of Las Vegas's largest hotel and casino groups were brought down without a single software vulnerability being exploited. Phone calls to IT help desks were enough: operators working with the group known as Scattered Spider talked their way into account resets, compromised an Okta environment and rolled out BlackCat/ALPHV ransomware. MGM's bill now runs past $100 million, with roughly ten days of downtime, and regulators are still investigating. The episode became the reference case for voice phishing aimed at enterprise identity.

Two groups hit back to back

MGM Resorts disclosed the attack in early September 2023. The company told the SEC, the US markets regulator, in a filing that state and federal regulators were examining the incident, per its annual report filed with the SEC in February 2024. On the ground the effect was immediate: systems across the Las Vegas properties shut down, and Group-IB puts the casino floor downtime at about ten days, with some systems still unavailable in the attack's aftermath, per The CyberWire's roundup.

At Caesars Entertainment, a social-engineering attack the company confirmed in September 2023 exposed loyalty-program member data, including driver's license and Social Security numbers, according to the company's Form 8-K filed on Sept. 14, 2023. Both attacks carry the fingerprint of the same ecosystem: Group-IB describes Scattered Spider as an English-speaking affiliate of ALPHV, the crew behind the BlackCat ransomware.

The mechanism: the help desk is the vulnerability

Nothing in the intrusion exploits a bug. It exploits a process. Group-IB sums it up: the group does not hack in through the firewall, it calls the help desk. Operators first gather public information about real employees, LinkedIn profiles and corporate directories, to build a credible pretext. They then contact IT support and ask for a password reset or the deactivation of multifactor authentication on that employee's behalf.

Once the identity door opened inside MGM's Okta environment, the attackers moved laterally using common remote-login software and access to the corporate VPN, which helped them evade the security team, as the Financial Times described in reporting cited by The CyberWire. The ransomware deployed was BlackCat/ALPHV. ESXi servers were reportedly encrypted, and the attackers claimed to have stolen about six terabytes of data from the two companies, per The CyberWire, figures that remain unverified.

Group-IB describes Scattered Spider as a loosely affiliated network of young English-speaking individuals from the US and the UK, without state sponsorship, and has identified more than 14 distinct subclusters. Their wider toolkit includes SMS phishing, SIM swapping to intercept authentication codes and MFA fatigue, flooding push notifications until the target approves one. Arrests and indictments in the US and the UK followed in 2024 and 2025 without extinguishing the method, according to Group-IB.

Different endings: pay or absorb

MGM refused to pay and paid elsewhere: Group-IB estimates losses above $100 million, echoed in the trade press, much of it operational disruption. Caesars, according to converging accounts carried by Group-IB, The CyberWire and the law firm McGriff, negotiated and reportedly paid a $15 million ransom, while telling investors it did not expect a material effect on its financial condition. The company has never publicly confirmed the payment.

The courts then caught up with MGM: on Jan. 21, 2025 the company agreed to pay $45 million to settle more than a dozen class-action lawsuits covering the 2019 and 2023 breaches, which together affected more than 37 million customers, per the official settlement notice and court filings.

What hospitality should take away

The perimeter is no longer the firewall, it is identity. Three defenses stand out in Group-IB's analysis: a strict, audited identity-verification procedure for any reset requested by phone, including for executives; real-time monitoring of identity-provider audit logs, watching for new privileged accounts, MFA configuration changes and bulk authentications from unusual locations; and phishing-resistant authentication, authenticator apps or hardware keys rather than SMS.

The playbook has proven replicable: Group-IB ties attacks on UK retailers M&S, Harrods and Co-op, plus Qantas in 2025, to the same social-engineering model. For a hotel, the IT help desk is now an attack surface that deserves the same engineering rigor as any network edge.