One Phone Call Cost Two Casinos $100 Million

****On August 28, 2026, U.S. prosecutors announced criminal charges against members of a hacking group accused of stealing at least $11 million in cryptocurrency and sensitive data from more than 45 companies across the US, Canada, India, and the UK. The charges include wire fraud, conspiracy, and aggravated identity theft.

The group goes by several names depending on which security researchers are tracking it — Scattered Spider, 0ktapus, Octo Tempest, Muddled Libra — but it's best known for something that happened three years earlier, in September 2023, that's worth understanding in detail even now: a single phone call that helped bring two Las Vegas casino giants to their knees.

The phone call

MGM Resorts and Caesars Entertainment are large, sophisticated companies with real security teams and, by all accounts, functioning multi-factor authentication. Scattered Spider didn't need to break either. They needed a phone number for MGM's IT help desk, some employee details pulled from LinkedIn, and about ten minutes of confident-sounding conversation.

Posing as a locked-out employee, the attackers convinced a help desk agent to reset a password and re-enroll their multi-factor authentication on an account with privileged access. That's the entire technical "hack." No malware, no exploited software vulnerability, no brute-force attack on a login screen—just a phone call to a person whose job is to help people who say they're locked out.

From there, the group moved into MGM's Okta identity environment, spread through the network, and ultimately deployed ransomware. The result: an estimated $100 million or more in losses and roughly ten days where slot machines, hotel key cards, and reservation systems across MGM's properties simply didn't work. Caesars, hit by the same group around the same time using similar tactics, reportedly paid a $15 million ransom rather than risk the same outcome.

This wasn't a one-time trick—it's a whole playbook, still active.

What makes this genuinely important to understand, rather than just a dramatic story from a few years ago, is that this group didn't stop. Security researchers have tracked the same core tactics—impersonating help desk or IT staff, "MFA fatigue" attacks (repeatedly sending login approval prompts until someone taps "approve" just to make the notifications stop), and SIM-swapping to intercept text-message codes—used against a wide range of companies since, including a wave of attacks against major UK retailers in 2025 that reportedly caused hundreds of millions of pounds in damage. The recent August 2026 charges are about this same, still-active group.

Why this matters even more if you don't have MFA at all

Here's the part worth sitting with if you're a small business owner: MGM and Caesars had multi-factor authentication, and it still wasn't enough on its own—because the attackers didn't try to break the technology; they targeted the human process for resetting it.

Now consider what happens when a business has no MFA in the first place. All of the elaborate social engineering described above—the LinkedIn research, the help desk phone call, the fake urgency—exists specifically to get around multi-factor authentication. If an account has none to begin with, an attacker doesn't need any of that. A single leaked or guessed password is the whole job. The entire playbook above is what criminals resort to specifically because MFA usually works—it's a testament to how effective the basic protection is that a well-resourced, patient criminal group had to build an entire social-engineering operation just to get around it.

What this actually means for your business

Two distinct lessons, both worth taking seriously:

If you don't have MFA turned on for your email and key business systems, that's the single highest-leverage fix available to you—it stops the overwhelming majority of basic credential-theft attacks outright, with no phone call, no social engineering, and no elaborate operation required to get past it.

If you do have MFA, make sure your staff know that an unexpected approval prompt should never be tapped "yes" on reflex—and if anyone ever calls claiming to be IT support asking to reset a password or MFA device, verify their identity through a channel you control (call back a known number) before doing anything, exactly the same instinct we've talked about before with fraudulent "urgent" emails.

Read the sourcing:

MITRE ATT&CK: Scattered Spider group profile—the security industry's own reference documentation on the group's tactics

Group-IB: Scattered Spider threat profile, including documented figures on the MGM and Caesars incidents

Not sure whether MFA is actually turned on across your own business's accounts? Starlen Cyber's free, non-intrusive external security assessment checks exactly this kind of gap—no installation, nothing touched on your systems, just a clear answer.

Request your free assessment: starlencyber.com · contact@starlencyber.com · 1-877-677-8275