MGM Resorts has discovered that the house doesn’t always win, finding itelf the victim of a cyberattack that at least temporarily took many of its services offline. With reports of digital room keys to slot machines to even check ins and check outs being unavailable, the organization has found itself facing questions as to how they were breached, and what may have been exposed, according to Vox.
At the moment, it’s believed a group called Scattered Spider is responsible, taking advantage of weaknesses in MGM’s IT help desk to impersonate an employee in a phone call, after which they were able to use their new access to launch a ransomware attack and encrypt data.
MGM Resorts isn’t the only gambling-focused company to be hit by this sort of attack recently, as Caesars Entertainment recently released a filing with the SEC indicating they had paid hackers millions of dollars to retrieve stolen data about members of their customer loyalty program, according to Vox. In that case, the filing stated the breach was the result of a social engineering attack on an outsourced IT vendor.
The breaches, both driven by social media, point to what is often the weakest part of cybersecurity, which is the individuals that make up an organization. It’s estimated over 90% of cyberattacks start with variants on phishing, and that phishing attacks that involve phone calls are three times as effective as those that don’t. Said Peter Nicoletti, global chief information security officer at Check Point Software, to Vox, “There’s always a little back door, and all the best defenses and all the expensive tools can be fooled by one good social engineering attack.”
Source:
https://www.vox.com/technology/2023/9/15/23875113/mgm-hack-casino-vishing-cybersecurity-ransomware
