MGM Resorts and Caesars attacks (2023)
Two September 2023 attacks on Las Vegas casino groups, carried out by social engineering against the IT help desk: one paid a ransom, the other refused and suffered a long outage.
Both attacks were attributed to Scattered Spider, a collective of young English speakers affiliated with the ALPHV ransomware. Their method was not technical at all: a call to the IT help desk, posing as an employee found on professional networking sites, was enough to get an access reset. The two groups then made opposite choices, and their SEC filings make it possible to compare them. Caesars paid and contained the incident; MGM refused and endured about ten days of visible disruption, from slot machines to room keys. For underwriting, the case put the help desk's verification procedure among the central questions, on a par with the multifactor authentication it can be used to bypass.
Caesars disclosed the incident to the SEC on September 14, 2023 and reportedly paid about 15 million dollars of the 30 million demanded. MGM, attacked starting September 10, refused to pay; in its October 5, 2023 filing it estimated the impact at about 100 million dollars on its quarterly earnings and said it expected its cyber insurance to cover it.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.