Back
Outfaze Security Team

Outfaze Security Team

MGM Cyber Incident: Identity and Continuity Lessons

MGM Cyber Incident: Identity and Continuity Lessons

MGM Resorts disclosed a cybersecurity issue in September 2023 and said it shut down certain systems while investigating. Later filings described operational disruption and unauthorized access to some customer information.

Public reporting often focuses on the social-engineering story, but the defensible lesson is broader: identity-verification failures can become a business continuity event when support staff can reset or redirect powerful access.

Identity recovery is a privileged workflow

Help desks operate under pressure and routinely assist users who cannot satisfy normal authentication. Attackers exploit that exception path by bringing convincing personal and organizational context to a call.

Once privileged access is obtained, broad internal tools and shared identity systems can increase the blast radius. Containment may require disabling systems, which means continuity plans must account for unavailable digital operations.

Harden people, process, and recovery paths

Require independent verification for sensitive resets, high-risk MFA changes, and administrator recovery. Use call-back procedures, manager approval, risk signals, and delays appropriate to the account's privilege and business impact.

Limit standing privilege, monitor help-desk actions, and alert on resets followed by unusual enrollment, login, or data access. Practice safe manual operations for revenue and customer processes that depend on central identity.

  • Treat help-desk tooling as privileged administration.
  • Do not rely on biographical knowledge as identity proof.
  • Separate account recovery from authorization expansion.
  • Test continuity when identity or endpoint systems are unavailable.

Put the lesson into practice

  1. Map high-impact reset and recovery workflows.
  2. Add independent verification and approval for sensitive changes.
  3. Reduce help-desk and administrator standing privilege.
  4. Correlate reset events with subsequent authentication.
  5. Exercise operational continuity during an identity incident.

Related Outfaze guidance

Authoritative sources