MGM Cyberattack: What the 2023 Incident Teaches About Identity Security

The September 2023 cyberattack on MGM Resorts is still useful to study because it shows how a security incident can move beyond IT and disrupt normal business operations.

MGM’s public filings described a cyber incident that affected systems across its United States properties. The company later estimated a negative impact of about $100 million to Adjusted Property EBITDAR for September, along with less than $10 million in one-time expenses during the quarter.

Those figures came from MGM itself. They show why identity security, incident response and business continuity need to be treated as operational priorities, not just technical controls.

What MGM Publicly Confirmed

MGM Resorts disclosed that it identified a cybersecurity issue in September 2023 and shut down certain systems to protect its environment. The disruption affected operations while the company worked to restore systems.

In an October 2023 filing with the U.S. Securities and Exchange Commission, MGM said the incident had a material effect on September results but that it did not expect a material effect on the full year. The company estimated the September impact at roughly $100 million to Adjusted Property EBITDAR and said one-time expenses were expected to be under $10 million for the third quarter.

MGM Resorts’ October 2023 SEC filing is the primary source for those financial estimates.

The filing is important because it separates confirmed company information from speculation surrounding the attack. Public reporting has discussed attacker groups and social-engineering techniques, but the company’s filing does not provide a complete technical attack narrative.

The First Lesson Is Bigger Than Ransomware

The MGM incident is often described in ransomware discussions, but the larger lesson is identity compromise and operational dependency.

Modern organizations rely on user accounts, administrator privileges, password resets, remote support, single sign-on and service identities to access critical systems. If an attacker can manipulate the identity recovery process, strong endpoint tools and network controls may not be enough.

A security program therefore needs to protect not only login authentication but also the ways an account can be recovered, reset or escalated.

Help Desk Identity Verification Is a Security Control

Help desks are designed to restore access quickly. That service goal can conflict with security when an attacker creates urgency, impersonates an employee or pressures staff to bypass normal verification.

A stronger recovery process uses multiple independent signals before changing access to a privileged or high-risk account. Depending on the organization, that can include:

• verified callback procedures
• manager or security approval for privileged resets
• identity checks that do not rely only on information available on social media
• separate handling for administrator accounts
• logging and review of unusual reset activity
• short-lived credentials or forced re-enrollment after high-risk recovery

The exact process should be strict enough to resist impersonation without making legitimate recovery impossible.

MFA Is Necessary, but Recovery Paths Matter Too

Multi-factor authentication can block many stolen-password attacks. It is not a complete identity strategy.

Security teams also need to review:

• how MFA devices are enrolled and replaced
• who can reset MFA
• which legacy protocols bypass modern authentication
• where service accounts have long-lived credentials
• which administrators can change authentication policies
• how emergency access accounts are protected

An attacker will look for the weakest path to a trusted identity. Sometimes that path is a password. Sometimes it is the recovery process around the password.

Privileged Access Should Be Harder to Obtain and Easier to Audit

Administrator access has a much larger blast radius than a normal employee account.

A mature identity design limits standing privilege. Administrators should use separate privileged accounts where appropriate, and high-impact permissions should be granted only for the time and task that require them.

Useful controls include privileged access management, just-in-time elevation, strong MFA, session logging and regular review of dormant administrative accounts.

The goal is not to make administration impossible. It is to prevent one compromised account from becoming unrestricted access to the wider environment.

Network Segmentation Limits the Blast Radius

Once an identity is compromised, segmentation can slow lateral movement.

Critical systems should not all trust the same network zone or administrator context. Payment systems, property operations, corporate applications, development systems and backups may require different trust boundaries.

Segmentation is most useful when it is paired with identity-aware access. Simply dividing a network into subnets does not create strong isolation if the same credentials can move freely between them.

For a broader security model, see our zero trust security guide.

Business Continuity Is Part of Cybersecurity

The MGM incident also illustrates why recovery planning must include business operations.

When digital systems are unavailable, employees need to know which services can continue manually, which systems must be restored first and how customers will be supported during the disruption.

A useful cyber recovery plan answers:

1. Which business services are most critical?
2. Which identities, applications and data do those services depend on?
3. How long can each service remain unavailable?
4. What manual fallback exists?
5. Which systems must be restored in what order?
6. How will the organization communicate with employees and customers?
7. How will recovered systems be verified before returning to production?

Backups are only one part of this process. Identity systems, configuration data, access policies and third-party dependencies also need recovery plans.

Incident Communications Need a Predefined Owner

A large cyber incident creates simultaneous pressure from customers, employees, regulators, insurers, partners and the media.

Security teams should not be deciding communication ownership for the first time during the incident. Legal, communications, executive leadership and technical responders need a predefined process for what can be confirmed, who approves public statements and how updates are documented.

Fast communication matters, but accuracy matters more. Speculation about attacker identity or technical details can create confusion and legal risk if the facts later change.

Monitor Identity Events, Not Just Malware

Many security programs are still better at detecting malicious files than suspicious identity behavior.

Useful identity signals include:

• unusual password or MFA resets
• new privileged role assignments
• logins from unexpected locations or devices
• rapid changes to authentication methods
• creation of new administrator accounts
• access to systems the user does not normally touch
• large changes in session or token behavior

These events should be correlated with endpoint and cloud telemetry rather than reviewed in isolation.

Our SIEM vs SOAR vs XDR guide explains how different security operations platforms support that work.

A Practical Identity Security Checklist

Organizations can use the MGM incident as a reason to test their own controls:

• review help-desk reset procedures
• require stronger verification for privileged accounts
• remove dormant administrator access
• protect MFA enrollment and recovery
• test emergency access accounts
• monitor high-risk identity changes
• segment critical systems
• verify offline or isolated backups
• run a tabletop exercise that includes identity-system failure
• define customer and regulatory communication workflows

A tabletop exercise is especially valuable because it exposes dependencies that architecture diagrams often miss.

What the MGM Incident Does Not Prove

One high-profile incident does not prove that a particular security product, architecture or authentication method always fails. It also does not mean every organization needs the same controls.

The useful lesson is more specific. Identity recovery, privilege management and operational resilience deserve the same design attention as malware prevention and perimeter security.

Security teams should use public incidents to test assumptions in their own environment rather than copy a checklist without understanding their risk.

Final Takeaway

MGM Resorts’ 2023 cyberattack became a business event because technology systems were deeply connected to normal operations. MGM’s SEC filing put the September financial impact at roughly $100 million, which makes the operational cost impossible to dismiss as an IT-only issue.

The strongest response is not fear of one attacker group. It is a disciplined identity program that protects account recovery, limits privilege, monitors suspicious changes, segments critical systems and rehearses recovery before a real incident occurs.

Author

Talha Qureshi is the founder and technology writer behind ITechTrove. He covers enterprise AI, cybersecurity, cloud infrastructure, B2B SaaS and emerging technology, focusing on practical guides, analysis and source-based reporting.