Yes—ALPHV/BlackCat claimed responsibility for the ransomware phase of the 2023 MGM Resorts cyberattack. That claim does not, by itself, prove that ALPHV conducted the initial intrusion. MGM confirmed unauthorized access, major operational disruption and the theft of certain customer information, but its public filings did not identify ALPHV as the confirmed perpetrator.
The short answer
ALPHV, also known as BlackCat, reportedly claimed around September 14, 2023, that it had deployed ransomware against MGM Resorts and downloaded exfiltrated data. The claim was later described in a consolidated class-action complaint, so it should be treated as an attributed attacker claim—not independent forensic proof.
As an Amazon Associate I earn from qualifying purchases.
Contemporary reporting associated the initial compromise with Scattered Spider, also known as UNC3944 and linked in some reporting to the Octo Tempest activity. The most careful description is that Scattered Spider was associated with the initial access while ALPHV claimed the ransomware stage. The groups may have collaborated or operated through an affiliate relationship, but they should not automatically be treated as the same organization.
MGM’s own disclosures confirmed the breach and its consequences without publicly naming either group as the conclusively established attacker. MGM’s initial SEC filing said the company identified a cybersecurity issue, notified law enforcement and shut down certain systems to protect operations and data.
#1 Best Overall
What happened at MGM?
The incident combined several different events that are often misleadingly compressed into the word “hack”: suspected social engineering or credential compromise, unauthorized access, acquisition of customer data, defensive shutdowns, operational disruption and an alleged ransomware deployment.
<
| Date | What is known |
|---|---|
| September 7, 2023 | A later consolidated complaint alleges that attackers began accessing MGM’s network after impersonating an IT administrator and obtaining credentials. This remains a litigation allegation, not an independently established fact. |
| September 11, 2023 | MGM later determined that unauthorized access had resulted in the acquisition of certain customer information on this date. |
| September 12, 2023 | MGM publicly disclosed a cybersecurity issue, said it had contacted law enforcement and announced that it had shut down certain systems. |
| Around September 14, 2023 | The later complaint says ALPHV claimed to have deployed ransomware and downloaded exfiltrated material. |
| September 20, 2023 | Contemporary reporting said MGM’s systems were substantially back online after approximately 10 days of disruption. |
| October 5–6, 2023 | MGM disclosed additional information about affected customers and estimated the financial impact on its operations. |
MGM’s October 2023 update said the company determined that an unauthorized third party had obtained certain customer information. The company’s filings also describe technology, legal and investigative costs associated with the incident.
What exactly did ALPHV/BlackCat claim?
ALPHV’s reported claim concerned the ransomware and data-exfiltration phase. It did not necessarily establish that ALPHV obtained the first credentials, impersonated an MGM employee or performed every action inside MGM’s environment.
That distinction matters because ransomware operations commonly use affiliates or access brokers. One criminal group may obtain access and move through a victim’s identity systems, while another deploys ransomware or negotiates the extortion. An attacker’s leak-site statement can provide useful context, but it is weaker evidence than a company’s verified investigation, independent technical analysis or a formal government attribution.
Associated reporting from The Associated Press connected ALPHV and Scattered Spider while cautioning that some public accounts relied on claims from the alleged attackers themselves.
ALPHV and Scattered Spider are not interchangeable
| Entity | Most accurate description |
|---|---|
| ALPHV/BlackCat | A ransomware operation commonly described as ransomware-as-a-service that claimed the ransomware phase of the MGM incident. |
| Scattered Spider/UNC3944 | An English-speaking cybercriminal cluster associated in reporting with social engineering, identity attacks and the initial MGM compromise. |
| MGM Resorts | The victim organization, which confirmed the incident’s effects but did not publicly confirm a named attacker in the cited filings. |
| Law enforcement | An investigative authority; the available sources do not establish a public final attribution by law enforcement. |
Which MGM systems and services were disrupted?
The outage affected customer-facing and internal operations across MGM properties. Reported or alleged effects included hotel reservations and booking services, MGM’s website, electronic room keys, Wi-Fi, ATMs, kiosks, electronic gaming devices, credit-card processing and other resort services.
The available evidence supports widespread disruption, not the claim that every slot machine or casino-floor device was independently hacked. Some disruption resulted from MGM’s decision to take systems offline as a protective and recovery measure. The 2025 consolidated complaint describes many of the operational effects as allegations; contemporary reporting also documented the broad outage.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →TechCrunch’s contemporary reporting described the outage and its connection to the reported Scattered Spider activity. The AP later reported that systems were substantially restored after approximately 10 days.
Rank #3
What customer data was exposed?
In its 2023 Form 10-K, MGM said criminals obtained certain customers’:
- Names
- Phone numbers
- Email addresses
- Postal addresses
- Gender
- Dates of birth
- Driver’s-license numbers
- Social Security numbers for a limited number of customers
- Passport numbers for a limited number of customers
MGM said it did not believe that customer passwords, bank-account numbers or payment-card information were obtained. That statement is important for customers assessing fraud risk, although exposed names, addresses, dates of birth and identity-document numbers can still create identity-theft and impersonation risks.
Do not confuse the September 2023 incident with MGM’s separate July 2019 data incident. The later civil settlement covered both incidents, but they were separate events. MGM’s customer-data disclosures are available in its 2023 Form 10-K.
Recommended Free Tools
How much did the MGM attack cost?
MGM estimated an approximately $100 million negative impact to adjusted property EBITDAR for its Las Vegas Strip and regional operations in September 2023. That is a specific operating-earnings measure—not automatically the company’s total damages, total remediation bill, total revenue loss or a ransom payment.
The estimate also does not capture every possible cost. MGM reported expenses involving technology consultants, legal advisers, investigations and remediation, along with potential litigation and regulatory exposure. The company’s October 2023 SEC filing explains the adjusted-EBITDAR estimate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Was MGM’s $100 million impact a ransom?
No. The $100 million figure was an estimate of the negative impact on adjusted property EBITDAR. It was not identified as a ransom.
The available primary sources do not verify whether MGM paid or refused a ransom. MGM disclosed the operational impact, insurance and recovery activity, but those facts do not establish the outcome of any ransom demand.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThat distinction is also important when discussing the later $45 million settlement. The settlement was a civil class-action resolution covering the 2019 and 2023 data incidents—not a payment to ALPHV or another hacking group.
Best Value
What happened legally afterward?
Consumers filed class actions in federal and state courts alleging, among other things, that MGM failed to use reasonable security procedures. According to MGM’s 2025 Form 10-K, insurers paid $45 million into a settlement fund in February 2025. A Nevada federal court approved the settlement and entered judgment in June 2025.
The official settlement administrator reported that payments for approved cash claims were sent on December 12, 2025. Readers checking eligibility, payment status or monitoring benefits should use the official MGM settlement website and its FAQ, rather than responding to unsolicited claim-filing advertisements.
MGM’s 2025 filing also noted continuing state-regulator investigations. A settlement resolves the specified civil claims; it does not turn every allegation about the intrusion into a proven technical fact.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What remains uncertain?
- Who obtained the initial access and credentials.
- Whether ALPHV directly conducted the initial intrusion or joined later as the ransomware operator.
- The complete amount of data exfiltrated.
- Whether MGM paid a ransom.
- The final outcome of all regulatory investigations.
The strongest evidence hierarchy is straightforward: MGM’s own disclosures and SEC filings establish the company’s confirmed findings; court documents establish allegations and reported attacker claims; independent reporting provides context; attacker statements remain claims unless corroborated.
What businesses can learn from the incident
The defensive lesson extends beyond encrypting malware. Organizations with large workforces, help desks and always-on operations should:
- Strengthen help-desk identity-verification procedures.
- Use phishing-resistant multifactor authentication for privileged and high-risk accounts.
- Monitor unusual identity-provider activity, privilege changes and authentication patterns.
- Segment critical operational systems from corporate identity and endpoint environments.
- Maintain isolated, tested backups and recovery procedures.
- Prepare customer communications, legal-notification processes and incident-response decision paths in advance.
- Treat identity-system compromise as a potential operational outage—not only a data-breach problem.
The bottom line on the MGM attribution
ALPHV/BlackCat did claim that it deployed ransomware against MGM Resorts. That is a real and relevant part of the incident’s history, but it is not the same as confirmed proof that ALPHV carried out the initial compromise. MGM independently confirmed unauthorized access, customer-data exposure and severe operational disruption; reporting associated Scattered Spider with the initial access. The careful conclusion is therefore: ALPHV claimed the ransomware phase, while the full division of responsibility for the intrusion remains less certain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
