MGM Resorts
A phone call to the IT help desk produced a credential reset. About ten days of disruption followed, all of it starting with a conversation. (Sources: CBS News, AP)
The Privileged Access Blind Spot: Hospitality
A ten-minute phone call to a help desk took a casino operator offline for ten days. The caller did not exploit anything. They asked for a password reset with enough real detail to sound like an employee, and got one. The incidents below are variations on that call.
Two pagesPublic reporting onlyFreeWritten by certified engineers
The incidents
Three breaches, one pattern
Marriott
Access inherited through a corporate acquisition with only limited vetting, sitting inside the network long enough to go unnoticed. (Source: ICO penalty notice)
Outsourced support
Identity providers and outsourced help desks treated as support functions rather than as the front door they actually are.
The read-across
What the pattern means for you
At 70% turnover, a property management system that touches everything, and a help desk trained to be helpful, the gap is people and process before it is technology. The technical controls matter, but the phone call comes first.
Self-check
The 60-second self-check
- Does your help desk verify identity before any password or MFA reset — and can the step be skipped under pressure?
- How many accounts belonging to people who left in the last year still have PMS access?
- Who holds admin on the property management system at each property, and is it a shared login?
- Is every path into the payment environment individual and MFA-protected?
- Have front-line staff heard the exact script an attacker uses on a help desk?
If any answer is "no" or "I would have to ask", that is the blind spot.
The full brief
Get the full brief
The two-page PDF adds the full account of each incident and the control that would have stopped it. Name and work email, and it comes straight back.
Next
Where to go next
The sector page: identity security for hospitality. The service that closes the gap: security awareness training. And a free audit is 30 minutes with a certified engineer on your own environment, findings in writing: Get a free audit.
Get the Hospitality brief
Name and work email. The two-page PDF covers each incident in full and the control that would have stopped it.