A male juvenile reportedly involved in a massive and “sophisticated” cyberattack on multiple Las Vegas casino properties, including MGM Resorts and Caesars, that cost the companies hundreds of millions of dollars, is in custody, authorities announced late last week.  

The costly scheme played out in 2023, between August and October, the Las Vegas Metropolitan Police Department said in a Sept. 19 news release.  

The alleged cyber intrusions were attributed to an organized threat-actor group that goes by the names “Scattered Spider,” “Octo Tempest,” “UNC3944” and “Oktapus.”  

As far as cyber-heists go, the scheme the hackers used on MGM Resorts, which operates MGM Grand, the Cosmopolitan, Bellagio, Luxor and Excalibur, was remarkably simple.  

Utilizing LinkedIn, a hacker impersonated an MGM Grand employee in a call with the company’s IT Department and requested a password reset, SFGATE reported, and gained access to MGM’s internal systems about 10 minutes later.  

Hackers then reportedly disabled slot machines and hotel key cards, blocked employee email access and prevented the hotel to book guests and take reservations. In a filing with the Securities and Exchange Commission, MGM Grand claimed a $100 million in losses.  

At around the same time, Caesars Entertainment said in an SEC filing that it was also hacked.  

In that case, the company said hackers gained access to customer data, such as driver’s license information and social security numbers of people enrolled in Caesars loyalty program.

While the financial damage in that hack is unknown, the company said in a statement that it had “taken steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result.” According to NBC News, cybersecurity experts widely believed the statement meant that Caesars paid the hackers for the hijacked data.  

The FBI’s Cyber Task Force, which includes LVMPD’s Cyber Investigative Group, assumed the investigation and identified the teen, who turned himself in at the Clark County Juvenile Detention Center on Sept. 17.

The male juvenile, who may end up being charged as an adult by the Clark County DA’s Office, is facing charges of extortion, obtaining and using another person’s identifying information to harm or impersonate and unlawful acts regarding computers, KTLA’s Las Vegas sister station 8News Now reported.  

Due to his status as a juvenile, the teen’s identity has not been released.