[Security](https://leakly.com/security/)

[Corroborated][Archive]

# MGM’s hack began with a help desk call, per @vxunderground — corroborated

@vxunderground said on Sept 13, 2023 that ALPHV got in via LinkedIn and a help desk call. Forbes reported the same account.

Published 09 Nov 2026, 09:08 UTC · Leaked on 13 Sep 2023, 00:45 UTC

Leaked on 13 September 2023

![Evidence tray card: MGM’s hack began with a help desk call, per @vxunderground — corroborated](https://leakly.com/assets/og/mgm-help-desk-call.png)

At 00:45 UTC on Sept 13, 2023, @vxunderground posted that the ALPHV ransomware group compromised MGM Resorts by finding an employee on LinkedIn and calling the help desk, and that the conversation took 10 minutes.

Later that day Forbes reported that the ALPHV/BlackCat group claimed responsibility and described the same route: social engineering via LinkedIn, then a call to the MGM help desk, in about 10 minutes.

Corroborated. The method comes from the attackers’ claims as reported; MGM’s own account of the entry point is not in the linked sources.

[Corroborated]

## What happened later

Corroborated: Forbes reported the same claimed method.

## Sources & captured post

> **vx-underground** @vxunderground
>
> All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk.
> A company valued at $33,900,000,000 was defeated by a 10-minute conversation.
>
> 4,544 likes · 1,058 reposts · counts as of 09 Nov 2026, 07:12 UTC
>
> [View the post on X](https://x.com/vxunderground/status/1701758864390050145) · not in our leaker index

### Original source & corroborating coverage

* [Original X post by @vxunderground](https://x.com/vxunderground/status/1701758864390050145)
* [Forbes — Inside The Ransomware Attack That Shut Down MGM Resorts](https://www.forbes.com/sites/suzannerowankelleher/2023/09/13/ransomware-attack-mgm-resorts/)

[Status definitions](https://leakly.com/editorial-guidelines/#status) · [Corrections](https://leakly.com/corrections/) · [Contact](https://leakly.com/contact/)