Situations in abundance at MGM Grand Back garden

Big Venues, Big Attack Surfaces: What MGM Grand Teaches Cyber Communities

The MGM Grand in Las Vegas is one of the largest hotel and entertainment complexes in the United States, hosting concerts, boxing nights, conventions and shows alongside its casino floor. For anyone in the security world, a venue on that scale is more than a night out. It is a working example of how many systems have to cooperate quietly: ticketing platforms, hotel booking engines, door access, payment terminals, loyalty programmes, guest Wi-Fi and the staff help desks that tie it all together.

MGM Resorts became a widely discussed case study in 2023, when a cyberattack disrupted operations across several of its properties. Public reporting pointed to social engineering aimed at the help desk as a key entry point. That single detail is why the story still comes up at meetups. It shows that the weakest link is often a phone call, not a zero-day.

Lessons worth bringing to the next meetup

• Identity verification matters. Help desk password and MFA resets need strong checks, because attackers impersonate employees convincingly.
• Segmentation limits damage. When guest-facing, payment and operational systems are separated, one compromise is less likely to stop everything.
• Incident response is a business skill. Clear communication with guests, staff and partners during an outage shapes how a breach is remembered.
• Threat intelligence pays off. Groups that target hospitality and entertainment tend to reuse tactics, and tracking them gives defenders a head start. Our threat feed is a good place to follow those patterns.

If you are attending an event there

Travelling to a large venue brings its own everyday security habits. Buy tickets only through the venue's official channels or well-known authorised sellers, and be wary of links in unsolicited emails or texts that claim to offer discounted seats. Use a VPN or your phone's hotspot instead of open Wi-Fi, keep card payments to contactless where you can, and switch off Bluetooth and auto-join networks while you are on a crowded floor. Check dates, entry rules and bag policies on the official site before you go, because these change between events.

Want to dig into case studies like this with other people in Austin? Look out for discussion nights on our events page, where real-world incidents get taken apart, compared and turned into practical defences.