MGM case: identity and access governance

In September 2023, MGM Resorts detected a cybersecurity issue in some of its systems. Days later, Las Vegas had casino floors shut down and guests whose room keys would not open their doors. On October 5, the company told the U.S. Securities and Exchange Commission (SEC) about a negative impact of roughly US$100 million on a key measure of its September results [1]. MGM did not describe the entry vector in its 8-K. According to the press, the attack began at a help desk; MGM did not confirm it [4]. This article focuses on the applicable governance controls.

It is written for the people who sign: general management, finance, operations, IT. It does not offer a list of tools. It offers what the case teaches, in business language, three questions for your next committee and one idea worth taking with you: today, your employees' identity is your company's perimeter.

One clarification before we start: Hábil did not take part in this case. We tell it from what the company reported to the SEC, what U.S. authorities published and what the serious press reported, each with its source. When something is a claim by the attackers or by an anonymous source, we say so.

First, one term

So that everyone at the table means the same thing:

• Identity provider: the system that decides who you are when you sign in to email, the ERP or payroll. Well-known examples: Microsoft Entra ID, Okta, Google Workspace, Keycloak. Its administration requires reinforced controls.

Ten days in September

Before: a warning almost nobody read as their own

An Okta guide from August 2023 recommends giving privileged accounts special protection [3]. That guide does not attribute the MGM incident.

Public sources do not make it possible to determine MGM's entry vector. Unconfirmed attributions by the press and by attackers are not used here to reconstruct it.

What guests saw

MGM later told the SEC that, as soon as it detected the problem, it shut down its systems to protect its customers' information, and that this caused disruptions at some of its properties [1]. It is a decision with a cost: cutting the power so the fire does not reach the warehouse.

From the outside, it looked like this. NBC News reported on September 15 casino floors closed, guests unable to get into their rooms with their electronic key and employees without access to corporate email [5]. The company, meanwhile, said that the vast majority of its services were still running, and later confirmed to the SEC the disruptions at some properties [1].

Next door, another house

Caesars Entertainment, the other large Las Vegas operator, filed its own report with the SEC on September 14 [8]. In it, it said something worth reading slowly: it detected suspicious activity on its network as a result of a social engineering attack on an outsourced IT support vendor that the company used. The intruder took a copy of its loyalty program database, with driver's license or Social Security numbers of a significant number of members. Its customer-facing operations were not disrupted [8]. (Social engineering is the technical name for tricking a person into handing over access.)

Two companies, the same month, the same city. The Caesars case is different and does not allow MGM's vector to be inferred.

The bill

On October 5, 2023, MGM filed a Form 8-K, the report that companies listed in the United States submit when something significant happens [1]. What it says, in business language:

• Roughly US$100 million of negative impact in September on its Adjusted Property EBITDAR, the measure it uses to track the operation of its resorts, adding together Las Vegas and its regional operations.
• Less than US$10 million in one-time expenses for technology consulting, legal counsel and other advisors.
• September occupancy was 88%, versus 93% the year before, because of lower bookings on its website and apps.
• The attackers obtained personal data of some customers who made transactions before March 2019: name, contact details, date of birth, driver's license number and, for a limited number, Social Security or passport number.
• The company said it did not believe customer passwords, bank account numbers or payment card information had been obtained, and that it expected its cybersecurity insurance to be sufficient, although the full extent of the cost had not been determined. Both were preliminary assessments as of October 5, 2023.

In other words: even with a quick response —shutting down in time, protecting the most sensitive data, having insurance— the incident translated into affected customers, disruptions and an estimated impact on the measure reported to the SEC.

The epilogue

In July 2024, British police, in coordination with the FBI and the UK's National Crime Agency, arrested a 17-year-old as part of a global investigation into a hacking community that had targeted several large companies, MGM among them [9]. The investigation continued. The CISA and FBI advisory was updated in 2025 because the group it describes kept changing its methods [2].

What a director should take away

1. Identity is the perimeter

For years, security was thought of as a wall: what is inside is trusted, what is outside is not. That wall has been fading. Your employees sign in from home, from their phones and from a third party's cloud; your vendors enter your systems; your systems talk to each other. The network, the devices and the backups still matter, but more and more, what separates an intruder from your operation is the question "who are you?" and how well your company answers it.

At MGM, the vector was not publicly detailed in the 8-K; the case does not allow it to be attributed to a call or to a specific procedure.

2. The weak point is the exception process, not the everyday one

Exceptional access processes require authorization, evidence and controls proportional to the privilege. Check that their design does not depend on a single decision that is hard to verify.

3. Outsourced support requires governance

Caesars' 8-K confirms a different case at a vendor [8]. If you outsourced support, review the contract, procedure and evidence without inferring MGM's vector.

4. Shutting down in time is costly, but not knowing who got in costs more

MGM shut down and still estimated a negative impact of roughly US$100 million on a key measure for a single month [1]. Now imagine the opposite scenario: not knowing which accounts were used, what they accessed and since when. A sufficient trail of accounts, accesses and times helps contain an incident and answer to auditors, regulators and customers. Evidence of who accessed what is not just an audit requirement: it is what helps you know when to stop shutting down.

5. The number that matters is not the attack's

No one can promise you that you will not be attacked. What can be governed is how much damage an incident does. Three governance levers: reinforced controls for privileged exceptions, least access and queryable records of access and permission changes.

None of the three is a product you buy and install. All three are design decisions that someone with authority has to make and sustain.

What this case does not say

To avoid drawing too many conclusions:

• It does not say the identity provider failed. MGM's 8-K does not allow the conclusion that an identity provider failed, nor does it identify the access procedure.
• It does not say training is useless. CISA and the FBI still recommend it [2]. It says it is not enough: a procedure that depends on a single person spotting a well-told lie, under pressure, concentrates risk; that is why it makes sense to add controls that can be verified.
• It does not say it will not happen to you because you are smaller. Companies of any size must govern their access exceptions.

Three questions for your next committee

1. How are access exceptions authorized, documented and reviewed, especially those with the highest privilege and those carried out by third parties?
2. Does our support vendor follow the same procedure we would require of our own staff, and how do we verify it?
3. If today we suspected that an account had been stolen, how long would it take us to know what it accessed and since when? Hours, days or weeks?

If any answer is "I don't know" or "it depends on who answers," the committee already has a topic to assign: an owner, a review date and the evidence it expects to see.

Where to start this week

Ask your IT area for the written procedure for access exceptions, the one really in use, not the one in the manual. Check that the procedure has an owner, reinforced authorization for privileges and reviewable evidence. Then ask for the list of accounts with administrator privileges at your identity provider. If the list is longer than you expected, you already have your first finding.

What Hábil does

Hábil is a Mexican engineering consultancy, founded in 2006, that connects your company's systems to a single corporate identity, with each person's permissions and a record of every access. We work with the identity provider you already have —Microsoft Entra ID, Okta, Google or Keycloak, among others— and connect it one system at a time, starting with the highest-risk one, so as not to interrupt the people already at work.

In terms of what this case teaches, that comes down to three things: reinforced controls for access exceptions, especially for the accounts with the most power; least access for every person, partner and vendor; and a queryable record of who accessed what and of every permission change, for Security and Audit. See the page Control who has access.

In a first conversation, your Leadership, IT and Security teams can walk away with four things made clear: which access processes require more control, which accounts need reinforced treatment, what evidence you are missing to answer Audit and what a next, well-scoped step would be.

Request your first conversation, at no cost. You take that access review with you. Write to us on WhatsApp.

Frequently asked questions

What happened at MGM Resorts in September 2023?

MGM detected a cybersecurity problem in some of its U.S. systems and shut them down to protect its customers' information, which disrupted part of its operations. The 8-K does not detail the entry mechanism. The company reported to the SEC a negative impact of roughly US$100 million on its September Adjusted Property EBITDAR [1].

What financial impact did MGM report?

According to its Form 8-K of October 5, 2023: roughly US$100 million of negative impact in September on its Adjusted Property EBITDAR, plus less than US$10 million in one-time expenses for consulting, legal counsel and advisors. It is not a net loss or a total cost, although the press summarized it as a US$100 million hit [7]. The company expected its insurance to be sufficient, without yet having determined the total cost [1].

Who is Scattered Spider?

It is the name that the industry and U.S. authorities use for a criminal group that, according to the joint CISA and FBI advisory, targets large companies, posing as employees or IT staff [2]. MGM's 8-K does not attribute the incident to that group.

Wouldn't a second factor have prevented this?

Identity controls must include a governed exception process; MGM's 8-K does not allow the conclusion of which control was missing.

Does this apply to a Mexican company that is not publicly listed?

The obligation to report may vary; the need to govern access exceptions also applies outside listed companies. The committee questions in this article are just as useful for a listed company as for one that is not.

Did Hábil take part in the MGM case?

No. This article is based only on public sources: MGM's and Caesars' reports to the SEC, the advisories from CISA, the FBI and Okta, and the press cited in the references.

Sources consulted on October 20, 2026. Claims by the attackers and by anonymous sources are flagged as such in the text.