Police: Teen hacker behind $100M cyberattack on Vegas Strip

An intricate and costly cyberattack on several prominent Las Vegas casino establishments, including MGM Resorts and Caesars, was recently uncovered to be perpetrated by a male juvenile, now in police custody. The elaborate operation unfolded between August and October of 2023, as reported by the Las Vegas Metropolitan Police Department.

The cyber intrusions were linked to an organized threat-actor group identified under various aliases such as “Scattered Spider,” “Octo Tempest,” “UNC3944,” and “Oktapus.” The modus operandi used by the hackers on MGM Resorts was surprisingly straightforward, with one hacker using LinkedIn to pose as an MGM Grand employee in a call with the company’s IT Department. This deception led to a password reset request being granted, ultimately allowing access to MGM’s internal systems merely ten minutes later.

The consequences of this cyberattack were severe, with reports of disabled slot machines, hotel key cards rendered inactive, employee email access being blocked, and disruptions to booking and reservation systems at MGM properties including the Bellagio and Luxor. In a disclosure to the Securities and Exchange Commission, MGM Grand confirmed losses amounting to $100 million due to the breach.

During the same timeframe, Caesars Entertainment also fell victim to a hack that compromised customer data, potentially including driver’s license details and social security numbers. The exact financial repercussions of this breach remain undisclosed, although Caesars assured the public that they had taken measures to ensure the deletion of any unlawfully obtained data by the hackers, though definitive guarantees could not be issued.

Upon initiating their investigation, the FBI’s Cyber Task Force, in collaboration with LVMPD’s Cyber Investigative Group, successfully tracked down the teenage cybercriminal responsible for the attack. He voluntarily presented himself at the Clark County Juvenile Detention Center, where he faces accusations of extortion, identity theft, and computer-related offenses. While potential charges as an adult loom, his identity remains confidential due to his status as a minor.

In conclusion, the financial and operational havoc wreaked by this cyberattack serves as a stark reminder of the ever-evolving threats posed by cybercriminals in the modern world, underscoring the necessity for robust security measures to safeguard critical systems and sensitive data from such malicious actors.