The MGM and Caesars Vishing Playbook, One Year Later

It has been about a year since social engineers walked into MGM and Caesars through the help desk, using nothing more sophisticated than a convincing phone call. The intrusions cost hundreds of millions of dollars and reshaped how casino operators think about identity verification on internal support channels.

What is striking, looking back, is how little of the playbook required novel technology. The attackers researched targets on LinkedIn, called the help desk, claimed to be locked out, and asked for a password reset. The verification controls in place were designed to be helpful, not skeptical, and that asymmetry was the entire vulnerability.

The lesson generalizes. Any internal channel that exists to help employees recover access is, by design, also a channel for impersonation. Hardening it requires verification methods that cannot be defeated by public information, escalation rules that slow down rather than speed up under pressure, and a willingness to inconvenience legitimate users in exchange for blocking attackers.

Most organizations still have not made that tradeoff. They will, eventually, but the question is whether they make it before or after their own incident.