{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T20:45:43.249Z",
  "tag": {
    "id": "social-engineering",
    "label": "Social Engineering",
    "isStack": false,
    "url": "https://pwn.watch/t/social-engineering",
    "feed": "https://pwn.watch/t/social-engineering/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "mgm-resorts-caesars-scattered-spider-2023",
      "title": "MGM Resorts and Caesars hit by Scattered Spider",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023",
      "json": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "MGM Resorts International; Caesars Entertainment",
      "tags": [
        "mgm-resorts",
        "caesars",
        "scattered-spider",
        "alphv",
        "ransomware",
        "social-engineering",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-09-07",
      "closedAt": "2023-10-05",
      "updatedAt": "2023-10-05",
      "summary": "Scattered Spider, an ALPHV/BlackCat affiliate, used social engineering to breach two Las Vegas casino giants. Caesars lost its loyalty program database and reportedly paid about $15M. MGM shut down systems for days and estimated a $100M hit, with pre-March-2019 customer data stolen.",
      "xPost": null
    },
    {
      "slug": "retool-sms-phishing-google-authenticator-sync-2023",
      "title": "Retool breach: SMS phishing, deepfaked voice call and synced MFA codes",
      "url": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023",
      "json": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Retool (cloud)",
      "tags": [
        "retool",
        "phishing",
        "social-engineering",
        "google-authenticator",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-08-27",
      "closedAt": "2023-09-13",
      "updatedAt": "2023-09-13",
      "summary": "An attacker phished a Retool employee by SMS, then called them with a deepfaked voice to get an MFA code. Because Google Authenticator synced codes to the employee's Google account, the attacker got their MFA codes too, and took over 27 cloud customer accounts, all in crypto.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "mgm-resorts-caesars-scattered-spider-2023",
      "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-05",
      "title": "MGM 8-K: about $100M impact on Adjusted Property EBITDAR, data of customers from before March 2019 stolen",
      "body": null,
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023"
    },
    {
      "incident": "mgm-resorts-caesars-scattered-spider-2023",
      "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-14",
      "title": "Caesars 8-K filing; reports say it paid about half of a $30M demand",
      "body": null,
      "sourceUrl": "https://www.cnbc.com/2023/09/14/caesars-paid-millions-in-ransom-to-cybercrime-group-prior-to-mgm-hack.html",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023"
    },
    {
      "incident": "retool-sms-phishing-google-authenticator-sync-2023",
      "incidentTitle": "Retool breach: SMS phishing, deepfaked voice call and synced MFA codes",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-13",
      "title": "Retool publishes its write-up",
      "body": null,
      "sourceUrl": "https://retool.com/blog/mfa-isnt-mfa",
      "url": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023"
    },
    {
      "incident": "mgm-resorts-caesars-scattered-spider-2023",
      "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-12",
      "title": "MGM statement on the cybersecurity issue",
      "body": null,
      "sourceUrl": "https://investors.mgmresorts.com/2023-09-12-MGM-RESORTS-INTERNATIONAL-STATEMENT-ON-CYBERSECURITY-ISSUE",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023"
    },
    {
      "incident": "mgm-resorts-caesars-scattered-spider-2023",
      "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-11",
      "title": "MGM Resorts discloses a cybersecurity issue and shuts down systems; reservations, slot machines and ATMs are disrupted",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/mgm-resorts-ransomware-attack-led-to-100-million-loss-data-theft/",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023"
    },
    {
      "incident": "mgm-resorts-caesars-scattered-spider-2023",
      "incidentTitle": "MGM Resorts and Caesars hit by Scattered Spider",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-07",
      "title": "Caesars determines the attacker copied its loyalty program database, including driver's license and/or SSNs for many members",
      "body": null,
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1590895/000119312523235015/d537840d8k.htm",
      "url": "https://pwn.watch/i/mgm-resorts-caesars-scattered-spider-2023"
    },
    {
      "incident": "retool-sms-phishing-google-authenticator-sync-2023",
      "incidentTitle": "Retool breach: SMS phishing, deepfaked voice call and synced MFA codes",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-08-27",
      "title": "SMS phishing and voice call lead to compromise of a Retool employee account and 27 cloud customers",
      "body": null,
      "sourceUrl": "https://retool.com/blog/mfa-isnt-mfa",
      "url": "https://pwn.watch/i/retool-sms-phishing-google-authenticator-sync-2023"
    }
  ]
}