The short version

A single phone call brought one of the world's largest casino operators to its knees. Attackers used social engineering to manipulate MGM Resorts' IT help desk into providing access credentials. Within days, slot machines went dark, hotel check-ins became manual processes, and guests faced cash-only transactions. The estimated cost exceeded $100 million. This attack demonstrates that the most sophisticated technical defenses can be undone by human factors. Social engineering remains the path of least resistance for determined adversaries.

Why this matters beyond a single product

This is not a story about casino technology. It is a story about how organizations authenticate identity. Every company with a help desk faces the same fundamental challenge: how do you help legitimate users while keeping attackers out? The MGM breach reveals that even organizations with substantial security investments can have gaps in their identity verification procedures. The lesson extends to any system where humans make access decisions. Password resets, MFA bypass requests, and account recovery flows are all potential attack vectors. Organizations must design these processes with the assumption that attackers will test them.

Practical next steps for teams

Start with your help desk procedures. Do they have clear identity verification steps that cannot be bypassed through persistence or charm? Implement out-of-band verification for sensitive requests. Require manager approval for high-risk changes like MFA resets or privileged account modifications. Then look at your privileged access management. Administrative accounts should require additional authentication, have limited session duration, and be monitored continuously. Finally, train your people. Social engineering works because it exploits normal human helpfulness. Regular training and simulated attacks help staff recognize and resist these techniques.

3SN perspective

Technology cannot solve what is fundamentally a human problem. But it can make the human decisions easier and safer. We believe the answer lies in combining smart identity verification processes with tools that reduce the burden on both staff and users. When security procedures are clear, consistent, and well-supported by technology, they become habits rather than obstacles. That is how you build resilience against social engineering: not by eliminating human judgment, but by supporting it with the right controls and training.