[et_pb_section fb_built=”1″ _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”0px||1px|||” global_colors_info=”{}”][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/NCSS-3397-Bulletin-Header-Footer-Header-Graphic-1600×350-Compressed.png” title_text=”NCSS-3397-Bulletin-Header-Footer-Header Graphic 1600×350-Compressed” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n
Published: November 15, 2023<\/em><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Our new bulletin Cyber Threat Watch<\/em><\/strong> has been created to help small businesses stay up to date on the latest threats, news, and events affecting their business. The content has been curated to make cybersecurity easy and accessible for both technical and nontechnical readers.<\/span><\/p>\n [\/et_pb_text][et_pb_heading title=”Featured Cyber Incident \u2014 MGM Casino Hack” _builder_version=”4.27.4″ _module_preset=”default” title_level=”h2″ title_font=”|600|||||||” title_text_color=”#00688E” hover_enabled=”0″ global_colors_info=”{}” custom_padding=”||12px||false|false” sticky_enabled=”0″][\/et_pb_heading][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_2,1_2″ _builder_version=”4.27.4″ _module_preset=”default” custom_margin=”-41px|auto||auto||” custom_padding=”18px||29px|||” global_colors_info=”{}”][et_pb_column type=”1_2″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/MGM-Grand-Hotel-Casino-_-Las-Vegas-Strip-e1756836722571.jpg” title_text=”MGM Grand Hotel & Casino _ Las Vegas Strip” _builder_version=”4.27.4″ _module_preset=”default” max_width=”92%” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font_size=”8px” custom_margin=”-15px|||||” global_colors_info=”{}”]<\/p>\n Image courtesy of MGM Resorts<\/em><\/p>\n [\/et_pb_text][\/et_pb_column][et_pb_column type=”1_2″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n As reported on September 11, 2023, MGM Resorts International, a U.S. hospitality and entertainment company, was the victim of a ransomware attack. This incident was first reported the day before and resulted in a breach of customer data, as well as encryption of the systems and data used to run operations in the Las Vegas hotel and casino. Many other properties went offline and, as a result, were forced to switch to manual mode. Customers had to rely on doormen to open their rooms!<\/span><\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”2px|||||” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Reportedly, the incident started with a phone call to MGM\u2019s IT help desk, for the purpose of committing a ransomware attack\u2014a classic case of social engineering through vishing. A group of perpetrators convinced an MGM employee that they were one of their vendors who had a business relationship with MGM. Their persuasive phone call enabled them to obtain the login credentials of one of MGM\u2019s key systems. Once in, they infected and encrypted the systems and demanded a payment of $100 million in crypto. As of this writing, the company has not paid the ransom.<\/span><\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”0px|||||” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_2_font=”|600|||||||” header_2_text_color=”#00688E” header_3_text_color=”#00688E” global_colors_info=”{}”]<\/p>\n The first lesson learned in reviewing this incident was to determine: how did the criminal gain access to such sensitive data as the login credentials? Using the lowest-paid IT person on the team? Or was it the compelling business data used in the conversation? Once the attacker convinced the help desk that he was a legitimate business partner, asking for login credentials was an easy first step. Leveraging the weakest link in the chain\u2014the human\u2014happens to us all.<\/span><\/p>\n Another lesson to be learned is: what was the information the help desk employee used in verifying the caller? One factor? Did the help desk keep the caller on the phone while he called the business? Probably not. Takes too long, too many calls to process? Information overload?<\/span><\/p>\n In closing, the most valuable lesson: we need to institute strict enforcement of user identity verification and access management. It is imperative that we limit access to the organization\u2019s resources and services to authorized personnel only, through a set of authentication processes such as incorporating the principles of least privilege, separation of duties, and multi-factor authentication (MFA).<\/span><\/p>\n Furthermore, it is crucial that all stakeholders be educated to properly handle and protect company resources. Assuming the ransom was not paid, the MGM must have had a backup plan and service in order to restore operations pre-hack.<\/span><\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” hover_enabled=”0″ global_colors_info=”{}” custom_padding=”60px||||false|false” sticky_enabled=”0″][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_divider _builder_version=”4.27.4″ _module_preset=”default” custom_margin=”||-2px|||” locked=”off” global_colors_info=”{}”][\/et_pb_divider][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_2_font=”|600|||||||” header_2_text_color=”#00688E” global_colors_info=”{}”]<\/p>\n https:\/\/abcnews.go.com\/Business\/wireStory\/cyberattack-mgm-resorts-expected-cost-casino-giant-100-103784725<\/a><\/p>\n https:\/\/www.dailymail.co.uk\/news\/article-12619797\/MGM-casino-hack-CEO-responds-100-million-loss-broken-machines.html<\/a><\/p>\n https:\/\/www.cisa.gov\/stopransomware\/ransomware-101<\/a><\/p>\n https:\/\/www.social-engineer.org\/framework\/attack-vectors\/vishing<\/a><\/p>\nLessons Learned<\/h3>\n
References<\/h2>\n