Documented incidentDisclosed 2023-09-13MGM ResortsSEC filing

Help-desk social engineering leads to ransomware and a systems shutdown at MGM Resorts (2023)

Social engineering of IT helpdesk reset admin credentials; ransomware deployed directly to ESXi hypervisors shutting down resort operations.

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Insufficient segmentation lets a foothold spreadOne compromised account, vendor or network segment reaches management planes, backups and everything else.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Verify identity out of band for credential resetsHelpdesk must verify the caller through a channel the caller does not control before resetting credentials or MFA for privileged accounts.
  • Protect the hypervisor management planePut virtualization management behind dedicated MFA-protected admin identities and separate it from general corporate credentials.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern