[Security](https://leakly.com/security/)

[Corroborated][Archive]

# MGM’s hack began with a help desk call, per @vxunderground — corroborated

@vxunderground said on Sept 13, 2023 that ALPHV got in via LinkedIn and a help desk call. Forbes reported the same account.

Leaked on 13 September 2023

![Evidence tray card: MGM’s hack began with a help desk call, per @vxunderground — corroborated](https://leakly.com/assets/og/mgm-help-desk-call.png)

At 00:45 UTC on Sept 13, 2023, @vxunderground posted that the ALPHV ransomware group compromised MGM Resorts by finding an employee on LinkedIn and calling the help desk, and that the conversation took 10 minutes.

> **vx-underground** @vxunderground
>
> All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk.
> A company valued at $33,900,000,000 was defeated by a 10-minute conversation.
>
> 4,544 likes · 1,058 reposts · counts as of 09 Nov 2026, 07:12 UTC
>
> — vx-underground (@vxunderground) [September 13, 2023](https://twitter.com/vxunderground/status/1701758864390050145)

not in our leaker index

Later that day [Forbes](https://www.forbes.com/sites/suzannerowankelleher/2023/09/13/ransomware-attack-mgm-resorts/) reported that the ALPHV/BlackCat group claimed responsibility and described the same route: social engineering via LinkedIn, then a call to the MGM help desk, in about 10 minutes.

Corroborated. The method comes from the attackers’ claims as reported; MGM’s own account of the entry point is not in the linked sources.

[Corroborated]

## What happened later

Corroborated: Forbes reported the same claimed method.

## Sources

* [Original X post by @vxunderground](https://x.com/vxunderground/status/1701758864390050145)
* [Forbes — Inside The Ransomware Attack That Shut Down MGM Resorts](https://www.forbes.com/sites/suzannerowankelleher/2023/09/13/ransomware-attack-mgm-resorts/)

[Status definitions](https://leakly.com/editorial-guidelines/#status) · [Corrections](https://leakly.com/corrections/) · [Contact](https://leakly.com/contact/)