Inspired by Danny Ocean? Hackers who breached casino giants also hit 3 other firms
Technology
Hacking group ALPHV has warned MGM of further attacks if it didn't strike a deal
SAN FRANCISCO (Web Desk/Reuters) – Some of you, if not many, must have watched the Hollywood movie Ocean’s 11 – starring Frank Sinatra, Peter Lawford and Dean Martin – in which Danny Ocean [Sinatra] along Jimmy Foster [Lawford] recruit nine others to simultaneously rob five Las Vegas casinos.
Although the heist was a great success, they didn’t get any money. Why? Watch the movie if you are really interested in what actually happened.
Then came a trilogy – Ocean’s Eleven, Ocean’s Twelve and Ocean’s Thirteen released in 2001, 2004 and 2007 respectively – with George Clooney playing the role of Danny Ocean ably assisted by Brad Pitt as Robert “Rusty” Ryan.
No doubt, Ocean’s Eleven was the best of the series and had lost the steam by the time we reached Ocean’s Thirteen.
However, there was another movie in 2018 – Ocean’s 8 – in which Sandra Bullock was leading the gang as Deborah "Debbie" Ocean, a professional thief and late Danny Ocean's sister. Her closest associate was Cate Blanchett [Lou Miller].
Why details of these Las Vegas casino heist movies are shared? Because of the recent hacking of casinos, which happened in real life.
Reuters in a report says the hackers who breached casino giants MGM Resorts International and Caesars Entertainment in recent weeks also broke into the systems of three other companies in the manufacturing, retail, and technology space, a security executive familiar with the matter said [So the hackers were more practical and didn’t limited to the Las Vegas casinos].
David Bradbury, chief security officer of the identity management company Okta, said five of the company's clients, including MGM and Caesars, had fallen victim to hacking groups known as ALPHV and Scattered Spider since August.
In an interview with Reuters, Bradbury didn't name the other companies, but said Okta was cooperating with official investigations into the breaches.
The hacks have cast fresh spotlight on ransomware attacks – cyber intrusions that affect hundreds of companies every year, from healthcare providers to telecom firms. MGM and Caesars lost market value last week as stock prices fell, and MGM is yet to recover from various operations disrupted at the hotels and gaming venues it owns from Las Vegas to Macau.
San Francisco-based Okta, which says it has more than 17,000 customers around the world, provides identity services such as multi-factor authentication used to help users securely access online applications and websites. Multiple breaches it identified at its customers last month prompted the company to issue an alert then, Bradbury said.
"We saw this happened in such a small period of time and we thought we should be coming forward to the industry at large and explaining what's happening here," he said.
At the time, Okta said its US customers were reporting a consistent pattern of attacks where hackers impersonated a victim firm's employees and convinced their information technology helpdesk into providing them duplicate access.
"We've seen consistently over the past six to 12 months, a ramp up in these types of attacks," Bradbury said.
MGM has not commented on the statement or the hack, beyond saying last week that it was dealing with a "cybersecurity issue." Caesars earlier said it was investigating the breach.
The financially-motivated hacking group ALPHV claimed the MGM hack in a post on its website Friday, and warned MGM of further attacks if it didn't strike a deal. It's unclear how much ransom ALPHV has demanded.
Bradbury said the group had breached into MGM and obtained access to its Okta client, which allowed it further access to more credentials in the identity management firm's system.
Scattered Spider appears to have worked with ALPHV on the latest hacks, Bradbury said, citing research by security analysts who have tracked both groups. "Think of them more as business associates or affiliates," he said.
Google's Mandiant Intelligence last week called Scattered Spider, also known as UNC3944, as one of the most disruptive hacking outfits in the United States. Bradbury said Mandiant's description of the group's tactics aligned with what Okta had observed in the recent hacks.
