MGM Resorts Social Engineering: 10-Minute Phone Call Costs $100 Million

MGM Resorts International suffered a devastating cyberattack that began with a social engineering phone call lasting approximately 10 minutes. The Scattered Spider hacking group impersonated an MGM employee during a call to the IT help desk and convinced the agent to reset credentials, providing initial access. The attackers then deployed ransomware that took down casino operations, hotel key card systems, reservation platforms, and ATMs across MGM properties nationwide for over a week. The attack cost MGM an estimated $100 million in lost revenue and remediation expenses. Hotel guests were locked out of rooms, casino floors went dark, and resort operations reverted to manual processes. The incident demonstrated how even sophisticated technical security can be circumvented through social engineering targeting the human element. It also exposed the risks of centralized IT infrastructure in hospitality, where a single compromise can cascade across an entire portfolio of properties.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.