In the ever-evolving landscape of cybersecurity, no organization is immune to the threat of a cyber attack. The MGM cyber attack stands as a stark reminder of this reality, showcasing how even industry giants can fall prey to sophisticated breaches. This incident not only disrupted MGM’s operations but also led to an estimated revenue loss of $8.4 million per day, alongside a wave of lawsuits from concerned customers. At the heart of this breach was a social engineering attack—a tactic that exploits human vulnerabilities rather than technical flaws. In this 1500+ word blog, we’ll explore the MGM cyber attack, unpack the critical lessons it offers, and provide actionable insights to help businesses protect themselves from similar threats. This content is optimized for the keyword social engineering attack to ensure visibility and relevance.

What Happened During the MGM Cyber Attack?

In 2023, MGM Resorts International, a global leader in hospitality and entertainment, faced a devastating cyber attack that brought its operations to a grinding halt. The breach disrupted everything from casino operations to hotel bookings, leaving the company scrambling to regain control. Reports estimate that MGM lost $8.4 million in revenue daily during the downtime, which lasted at least ten days. Beyond the financial hit, the attack triggered a flood of class-action lawsuits from customers worried about the safety of their personal and financial data.

The root cause? A cleverly executed social engineering attack. Hackers didn’t exploit a software vulnerability or bypass a firewall—they targeted a far more unpredictable element: human error. Using publicly available information from LinkedIn, the attacker identified a current MGM employee, assumed their identity, and contacted the company’s IT help desk. Posing as the employee, the hacker requested assistance logging into restricted accounts. Unwittingly, the help desk complied, granting the intruder access to MGM’s systems. From there, the hackers exfiltrated sensitive client and business data, leaving MGM to deal with the fallout.

This breach serves as a wake-up call for businesses worldwide. Let’s break down the key lessons from this incident and how they can help you safeguard your organization against social engineering attacks.

Lesson 1: The Power of Social Engineering Attacks

A social engineering attack preys on human psychology rather than technical weaknesses. In the MGM case, the hacker didn’t need advanced coding skills or zero-day exploits. Instead, they leveraged publicly available information and basic social manipulation to trick an employee into granting access. This approach highlights why social engineering attacks are among the most dangerous threats businesses face today—they exploit the one variable that’s hardest to control: people.

Why Are Social Engineering Attacks So Effective?

• Human Error is Inevitable: No matter how robust your cybersecurity systems are, employees can still make mistakes. A single lapse in judgment—like failing to verify a caller’s identity—can open the door to a breach.
• Accessible Information: Platforms like LinkedIn provide a treasure trove of data for attackers. Job titles, employee names, and organizational structures are often just a click away.
• Trust is a Weakness: Employees, especially those in customer-facing roles like IT help desks, are trained to be helpful. Attackers exploit this instinct to bypass security protocols.

How to Protect Against Social Engineering Attacks

The MGM breach underscores the need for ongoing employee training and awareness. Here’s how to reduce your vulnerability:

• Regular Training: Conduct frequent cybersecurity awareness programs that simulate social engineering attacks like phishing emails, pretexting calls, or impersonation attempts.
• Verification Processes: Implement strict protocols for verifying identities, especially for sensitive requests like password resets or account access. Multi-factor authentication (MFA) can add an extra layer of protection.
• Limit Public Exposure: Encourage employees to minimize the personal and professional details they share online, particularly on platforms like LinkedIn.

By prioritizing human-focused defenses, businesses can close the gaps that social engineering attacks exploit.

Lesson 2: Monitoring and a Robust Crisis Plan Are Non-Negotiable

MGM’s IT team detected unusual activity and took swift action by deactivating servers and infrastructure. However, the hackers had already exfiltrated critical data, proving that detection alone isn’t enough—every second counts. This raises a critical question: Does your business have a crisis plan in place to respond to a social engineering attack or other breaches?

The Importance of Real-Time Monitoring

Proactive real-time monitoring can help identify suspicious behavior before it escalates. In MGM’s case, the hackers’ initial access via the help desk went unnoticed until it was too late. Real-time monitoring tools, combined with anomaly detection, can flag unusual login attempts, data transfers, or system changes.

Crafting an Effective Crisis Plan

A well-defined crisis plan ensures that your team knows exactly what to do when a breach occurs. Key components include:

• Incident Response Team: Designate a group of IT professionals and decision-makers to lead the response effort.
• Communication Protocols: Establish clear lines of communication with employees, customers, and stakeholders to manage the narrative and maintain trust.
• Containment Strategies: Outline steps to isolate affected systems and prevent further damage.

If MGM had acted faster or had a more robust crisis plan, the damage might have been mitigated. Ask yourself: Is your internal IT staff or technology provider equipped to minimize losses in the wake of a social engineering attack?

Lesson 3: Branding and Trust Take a Hit

The fallout from the MGM cyber attack extended far beyond operational downtime. The company faced multiple class-action lawsuits, with customers alleging negligence in protecting their personal and financial information. This legal and reputational damage could cost MGM millions more in settlements and lost business. For any organization, a social engineering attack can erode customer confidence and tarnish a brand’s credibility.  After all, anyone in the tech space now associates MGM’s brand with a historical social engineering attack versus what they are known for.

The Ripple Effect on Customer Trust

When a breach occurs, customers expect transparency and accountability. MGM’s customers felt betrayed, and many likely questioned whether they could trust the brand moving forward. This loss of trust can have long-term consequences:

• Customer Churn: Clients may take their business elsewhere, seeking companies with stronger security reputations.
• Negative Perception: Publicity surrounding the breach can create a lasting negative reference point for the brand.
• Legal Liabilities: Lawsuits can drain resources and further damage public perception.

Protecting Your Brand

To mitigate the branding impact of a social engineering attack, consider these steps:

• Proactive Communication: If a breach occurs, notify customers promptly and outline the steps you’re taking to address it.
• Invest in Security: Demonstrate a commitment to protecting data with visible measures like encryption, regular audits, and employee training.
• Build Resilience: A strong brand can weather a crisis if customers trust your response and recovery efforts.

Your business’s reputation is tied to how well you safeguard customer data. A single social engineering attack can undo years of goodwill if you’re unprepared.

Lesson 4: Backup and Recovery Strategies Are Your Safety Net

While the specifics of MGM’s backup and recovery strategy remain unclear, the fact that operations were down for at least ten days suggests gaps in their approach. A solid backup and recovery plan could have allowed MGM to resume limited operations sooner, minimizing losses. This is a critical lesson for any business facing the threat of a social engineering attack.

Why Backup and Recovery Matter

Once hackers gain access—whether through a social engineering attack or another method—they can encrypt, delete, or steal data. Without a reliable backup, recovery becomes a slow and costly process. MGM’s extended downtime highlights the need for off-site, secure, and regularly tested backups.

Building a Robust Backup Plan

Here’s how to ensure your business can bounce back quickly:

• Off-Site Backups: Store data in a secure, separate location to protect it from on-site breaches or ransomware.
• Cloud Solutions: Leverage cloud data management or private cloud services for scalable, accessible recovery options.
• Regular Testing: Simulate breaches to verify that your backups work and can be restored efficiently.
• Redundant Systems: Use colocation or off-site servers to maintain critical operations during a crisis.

A comprehensive backup and recovery strategy can be the difference between a minor disruption and a catastrophic failure. Don’t let a social engineering attack leave your business offline for weeks.

Don’t Underestimate the Threat of Social Engineering Attacks

The MGM cyber attack of 2023 is a sobering case study in the devastating potential of social engineering attacks. By exploiting human error, hackers bypassed MGM’s technical defenses, exfiltrated sensitive data, and triggered a cascade of financial, legal, and reputational consequences. The lessons are clear: businesses must prioritize employee training, implement robust monitoring and crisis plans, protect their brand, and invest in backup and recovery strategies.

In today’s digital landscape, a social engineering attack can strike at any moment. Whether it’s a phishing email, a pretexting call, or an impersonation scam, the human element remains your greatest vulnerability—and your first line of defense. By learning from MGM’s experience, you can fortify your organization against this pervasive threat. Are you ready to protect your business from the next social engineering attack? Contact us today to get started with a Cyber Security Risk Assessment.