# MGM Resorts and Caesars hit by Scattered Spider · pwn.watch

> Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.

Page: https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023 · generated 2026-10-22T19:29:07.289Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: MGM Resorts International; Caesars Entertainment
- Started: 2023-09-07 · closed: 2023-10-05

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023/feed.xml
- JSON Feed: https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023.json
- This file: https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023/llms.txt

## Updates (newest first)
- 2023-10-05: MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen (https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm)
- 2023-09-14: Caesars 8-K filing; reports say it paid about half of a $30M demand (https://www.cnbc.com/2023/09/14/caesars-paid-millions-in-ransom-to-cybercrime-group-prior-to-mgm-hack.html)
- 2023-09-12: MGM statement on the cybersecurity issue (https://investors.mgmresorts.com/2023-09-12-MGM-RESORTS-INTERNATIONAL-STATEMENT-ON-CYBERSECURITY-ISSUE)
- 2023-09-11: MGM Resorts discloses a cybersecurity issue and shuts down systems; reservations, slot machines and ATMs are disrupted (https://www.bleepingcomputer.com/news/security/mgm-resorts-ransomware-attack-led-to-100-million-loss-data-theft/)
- 2023-09-07: Caesars determines the attacker copied its loyalty program database, including driver's license and/or SSNs for many members (https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm)

## Fix brief
# Security brief: MGM Resorts and Caesars hit by Scattered Spider

Source: https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023 · status: closed (closed Oct 5, 2023) · severity: high · updated Oct 5, 2023

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.

Severity detail: Ransomware and extortion; social engineering of IT help desk / outsourced IT support

- Product: MGM Resorts International; Caesars Entertainment

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Latest updates
- Oct 5, 2023: MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen
- Sep 14, 2023: Caesars 8-K filing; reports say it paid about half of a $30M demand
- Sep 12, 2023: MGM statement on the cybersecurity issue
- Sep 11, 2023: MGM Resorts discloses a cybersecurity issue and shuts down systems; reservations, slot machines and ATMs are disrupted
- Sep 7, 2023: Caesars determines the attacker copied its loyalty program database, including driver's license and/or SSNs for many members

## Advisories
- [Caesars Entertainment Form 8-K (Sept 14, 2023)](https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm) (SEC / Caesars)
- [MGM Resorts International Form 8-K (Oct 5, 2023)](https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm) (SEC / MGM Resorts)

## Write-ups & news
- [MGM Resorts statement on cybersecurity issue](https://investors.mgmresorts.com/2023-09-12-MGM-RESORTS-INTERNATIONAL-STATEMENT-ON-CYBERSECURITY-ISSUE)
- [Caesars paid millions in ransom to cybercrime group prior to MGM hack](https://www.cnbc.com/2023/09/14/caesars-paid-millions-in-ransom-to-cybercrime-group-prior-to-mgm-hack.html)
- [Hackers say they stole 6 terabytes of data from casino giants MGM, Caesars](https://www.reuters.com/business/casino-giant-caesars-confirms-data-breach-2023-09-14/)
- [MGM Resorts ransomware attack led to $100 million loss, data theft](https://www.bleepingcomputer.com/news/security/mgm-resorts-ransomware-attack-led-to-100-million-loss-data-theft/)

## Caveats
The ~$15M Caesars payment is from press reports (CNBC/WSJ), not from the 8-K.

---
Machine-readable: https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.