Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Okta technology was reported as an access vector in the September 2023 attacks on MGM Resorts and Caesars Entertainment, but that does not prove an Okta software vulnerability caused either intrusion. Reuters reported Okta chief security officer David Bradbury saying MGM and Caesars were among five Okta customers attacked by groups identified as ALPHV and Scattered Spider since August 2023. Okta said it was cooperating with official investigations.
What happened to MGM and Caesars?
The two casino companies disclosed separate cybersecurity incidents in September 2023. Contemporary reporting linked both companies to a broader campaign targeting Okta customers, while the companies’ filings described different publicly known effects and left important technical details undisclosed.
MGM Resorts
MGM announced a cybersecurity issue affecting some systems on September 12, 2023. Its later Form 8-K described response measures, operational disruption, customer-data findings and an estimated financial effect. MGM’s October customer notice said unauthorized access to some customer personal information occurred on September 11.
MGM reported that information for customers who had transacted before March 2019 was obtained in some cases. The categories included names, contact details, gender, dates of birth and driver’s-license numbers; for a limited number of customers, Social Security or passport numbers were also involved. MGM said it did not believe passwords, bank-account numbers or payment-card information were obtained. The data categories were not necessarily the same for every affected customer.
Caesars Entertainment
Caesars’ September 14 SEC filing said an outsourced IT support vendor was involved in its incident. At the time of that filing, Caesars said the full costs and impacts—including the scope of accessed data—remained undetermined. The public record therefore does not support treating Caesars’ impact as identical to MGM’s or assigning it the same data and financial consequences.
What Okta confirmed—and what it did not
In a Reuters report published September 18 and updated September 19, Bradbury said MGM and Caesars were two of five Okta clients attacked since August by ALPHV and Scattered Spider. He also said Okta was cooperating with official investigations.
Rank #2
Computer Weekly characterized Bradbury’s comments as confirmation that the attackers appeared to have exploited Okta technology as an access vector. In this context, “access vector” means the identity and access systems were part of the route used to reach a victim environment. It is not the same as evidence that Okta code contained a vulnerability or that an Okta product defect was the root cause.
The reported help-desk pattern
Reuters described a pattern observed by Okta in which attackers impersonated victim-company employees and persuaded IT help desks to issue duplicate access. That is a social-engineering technique involving identity-verification and account-recovery procedures. The reporting does not establish that every detail of this pattern occurred in exactly the same way at both casinos, nor does it provide a complete independently verified forensic chronology for either company.
Rank #3
Attacker claims are not the same as findings
ALPHV and Scattered Spider were named in the reporting, but claims made by ransomware groups should not automatically be treated as independently proven facts. The strongest supported statement is that Okta’s CSO said the groups had targeted Okta customers and that contemporary coverage described Okta identity technology as an apparent access route.
Timeline of the publicly reported events
- August 2023: Bradbury said the broader wave against Okta customers had begun by this month.
- September 11, 2023: MGM later said unauthorized access to some customer personal information occurred on this date.
- September 12, 2023: MGM announced a cybersecurity issue affecting some systems.
- September 14, 2023: Caesars filed a Form 8-K referring to an outsourced IT support vendor and saying the incident’s full scope and costs were still undetermined.
- September 18–19, 2023: Reuters published and updated its report of Bradbury’s comments about five targeted Okta customers, including MGM and Caesars.
- October 2023: MGM issued its customer notice and disclosed additional information about affected data and identity-protection services.
How the MGM and Caesars disclosures compare
| Comparison point | MGM Resorts | Caesars Entertainment |
|---|---|---|
| Public confirmation | Announced a cybersecurity issue on September 12, 2023; later filings and a customer notice described response, disruption and data findings. | September 14, 2023 Form 8-K identified an outsourced IT support vendor involved in the incident. |
| Reported technical context | Contemporary reporting linked the incident to the broader attacks on Okta customers; a complete public forensic sequence was not supplied. | Contemporary reporting linked it to the same broader campaign; the filing did not publish a complete technical sequence. |
| Data disclosed | Some customer information, varying by person: names, contact details, gender, birth dates and driver’s-license numbers; limited Social Security or passport numbers. MGM said passwords, bank-account numbers and payment-card information were not believed to be obtained. | Full scope of accessed data was not determined in the September filing. |
| Financial effect | Approximately $100 million negative impact to Adjusted Property EBITDAR for Las Vegas Strip Resorts and Regional Operations in September 2023. MGM said this estimate was limited to that period and measure. | Not stated in the cited September filing; costs and impacts remained undetermined at that time. |
| Operational detail | Filing described significant response actions and disruption to systems and operations. | Specific operational effects were not established in the cited filing. |
What the $100 million MGM figure means
MGM’s Form 8-K estimated an approximately $100 million negative impact to Adjusted Property EBITDAR for its Las Vegas Strip Resorts and Regional Operations in September 2023. This is a company estimate for a defined business measure and period—not a total lifetime cost, a figure for both casinos, or a measurement of all cyber-related losses.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why “Okta link” should not be read as “Okta vulnerability”
Three statements are often collapsed into one, but they describe different levels of certainty:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Supported by Reuters: Okta’s CSO said MGM and Caesars were among Okta customers targeted in the campaign and that Okta was cooperating with investigations.
- Reported characterization: Computer Weekly described Okta technology as an apparent access vector.
- Not established by these disclosures: that an Okta product vulnerability caused either casino intrusion, that the same exploit chain operated at both companies, or that a final law-enforcement attribution had been published.
The available accounts also do not establish whether any weakness was in software, in an organization’s configuration, or in human account-recovery processes. Calling the technology an access vector is therefore more precise than calling it the technical root cause.
Best Value
A separate Okta incident in October 2023
Okta later disclosed a breach of its support system in October 2023 and described remediation for that event. That support-system incident was separate from the September casino attacks. Combining the two can incorrectly suggest that the casino intrusions resulted from the later support-system breach.
What remains unknown
- A complete, independently verified attack chronology for MGM and Caesars.
- Whether the same social-engineering sequence was used at both companies.
- A confirmed software vulnerability in an Okta product as the cause.
- The final scope and cost of the Caesars incident as of its September filing.
- A final public law-enforcement finding that resolves every attribution question.
MGM said in its October 2023 Form 8-K: “While no company can ever eliminate the risk of a cyber attack, the Company has taken significant measures, working with industry-leading third-party experts, to further enhance its system safeguards.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →
