For banks, the MGM and Caesars intrusions were about the few accounts that run the identity platform

The week

On September 11, 2023, MGM Resorts disclosed a cybersecurity issue that disrupted systems across its properties, including reservations, slot machines and digital room keys, for days. Within the week, reporting attributed the intrusion to a group widely known as Scattered Spider, working with the ALPHV ransomware operation, and described initial access through a social engineering call to MGM’s IT help desk. On September 14, Caesars Entertainment disclosed in an SEC filing that attackers had taken data, including its loyalty program database, after a social engineering attack on an outsourced IT support vendor. Two weeks earlier, Okta had warned customers that callers were persuading help desks to reset multi-factor authentication for highly privileged administrators. In October, MGM estimated the hit to its third-quarter adjusted earnings at about $100 million.

Help desk social engineering was not new in 2023. Earlier articles in this series looked at the 2020 Twitter intrusion and a 2021 brokerage breach, both about how agents verify callers. The casino attacks added something more specific for banks, broker-dealers and credit unions. According to Okta’s warning and the reporting that followed, the goal of the calls was administrative control of the identity platform itself: the accounts that decide who can sign in to everything else. Most institutions have tens of thousands of user accounts and only a few dozen of these. We look at the problem in three parts, which together describe how a control-plane takeover succeeds: the accounts that run the identity platform, the people permitted to recover them, and the events that would reveal a takeover in progress.

The accounts that run the identity platform

A bank’s identity provider is trusted by its email, core banking front ends, wire systems, cloud consoles and remote access gateway. Whoever administers it can add a sign-in method to any account, trust a new external identity provider, or change the policy that requires multi-factor authentication. Okta described attackers using exactly these powers after a successful reset.

The first task is to list these accounts precisely. The list includes super administrators of the identity platform, global administrators of the cloud productivity tenant, administrators of the privileged access vault, owners of cloud subscriptions, and service accounts with directory write rights. Many institutions find the number is higher than expected, because vendors, consultants and former project teams were granted rights years earlier and never removed.

Once listed, these accounts can be treated differently from the rest. Each should be a separate account from the person’s daily identity, with no mailbox and no web browsing. Each should use phishing-resistant authenticators only, such as hardware security keys bound to that account, with a second registered key held in a safe. Standing access can be replaced with just-in-time elevation that expires within hours. A bank that reduces this population from fifty to ten has cut the attacker’s target list by four-fifths without touching the help desk.

There is a cost. Administrators lose some convenience, and break-glass procedures must be tested so that the institution is not locked out of its own tenant during an outage. Those procedures need a named custodian for the emergency credentials, a sealed record of each use, and a quarterly test. That is a small price for removing most of the targets a caller would ask for.

The people permitted to recover them

Recovery is the weak point because it exists to bypass authentication. For ordinary staff, improving the help desk script is reasonable. For control-plane accounts, the right number of help desk agents able to reset them is zero. Recovery should require two named people from the identity or security team. At least one should verify the requester in person, or on video against a photo already held by human resources, and the action should be logged and reported to the CISO the same day.

Caesars showed why outsourcing deserves separate attention. Many banks use a managed service provider for first-line IT support, sometimes offshore and sometimes shared with other clients. The contract usually sets response times and satisfaction targets. It rarely specifies which accounts the provider’s agents may never touch, what verification they must perform for the rest, how calls are recorded, and how quickly the bank is told of an unusual request. Those terms belong in the statement of work, with technical enforcement behind them: the provider’s agents should lack the permission to reset privileged accounts, so that a convincing caller cannot succeed. Bank examiners already expect third-party risk management to cover providers with access to critical systems, and an outsourced help desk is one of them.

The events that reveal a takeover

Some social engineering will still succeed, so the third part is detection. The events that matter are generated by the identity platform rather than by endpoints or the network. They include a new authenticator enrolled shortly after a reset, and a reset followed by a sign-in from an unfamiliar network. Others are a new external identity provider added to the tenant, an administrator role assigned outside a change window, or a relaxed authentication policy. Many security operations centers were built around endpoint and network alerts and ingested identity logs mainly for investigation after the fact.

Each of these events should raise a high-severity alert with a responder available at any hour. Response needs pre-approved authority to disable an administrator account, revoke all its sessions and roll back its configuration changes without waiting for a change advisory board. A tabletop exercise built on the casino timeline, in which a privileged reset happens on a Sunday evening, will show quickly whether that authority exists. Two numbers are worth reporting to the board risk committee: the count of control-plane accounts, and the measured time from a privileged reset to an analyst looking at it.

With hindsight

The same approach kept working. Groups associated with Scattered Spider used help desk social engineering against major retailers in the United Kingdom in spring 2025 and against U.S. insurers and airlines that summer, prompting renewed warnings from the FBI and CISA. U.S. prosecutors charged several alleged members in late 2024, and British and U.S. authorities made further arrests and filed charges in 2025, without ending the activity. Phishing-resistant authentication and just-in-time administration spread through larger institutions, and identity threat detection became a recognized product category, though adoption among smaller banks and credit unions was uneven. The 2023 pattern held: intrusions tended to succeed where an institution had strong authentication and a recovery process that a capable caller or an outsourced agent could still trigger.