Hacker thought to be behind to MGM attack arrested by UK police

Ransomware
(Image credit: Pixabay)

A 17-year-old boy has been arrested in Walsall, England on suspicion of taking part in the ransomware attack against MGM Resorts,..

The West Midlands Police confirmed the arrest via a press release published late on Friday, saying the action was part of a larger campaign in which both the UK’s National Crime Agency (NCA) and the FBI, participated.

“We have arrested a 17-year-old boy from Walsall in connection with a global cyber online crime group which has been targeting large organizations with ransomware and gaining access to computer networks,” the notification reads.

Names, addresses, and phone numbers

“The suspect was taken into custody on suspicion of Blackmail and Computer Misuse Act offenses and has been released on bail while we continue with our enquiries,” the police added. “We also recovered evidence at the address including a number of digital devices which will undergo forensic examination.”

A hacking collective known as Scattered Spider targeted MGM Resorts International’s computer systems in September 2023, affecting some casino and hotel computer systems including the company’s website. Mandiant Intelligence’s CTO, Charles Carmakal, spoke on LinkedIn about the group, also known as UNC3944, calling it “one of the most prevalent and aggressive threat actors impacting organizations in the United States today.”

Apparently, the attackers used vishing (voice phishing) to call an MGM Resorts employee and impersonate IT helpdesk. That way, they obtained network access credentials, which allowed them to deploy the ransomware, which ultimately cost the company at least $100 million.

The attack triggered an investigation from the FBI which, the West Midlands police confirmed, is now looking into Scattered Spider.

“The arrest is part of a global investigation into a large scale cyber hacking community which has targeted a number of major companies which includes MGM Resorts in America.”

Detective Inspector Hinesh Mehta, Cyber Crime Unit Manager, at ROCUWM, warned cybercriminals to stop attacking firms with ransomware: "We want to send out a clear message that we will find you. It’s simply not worth it.”

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
The British Museum main entrance
British Museum forced to partly close following cyberattack by ex-worker
Ransomware
8base ransomware site taken down in global police operation
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
UK private health services firm told to pay up $2m for ransomware hit
Cyber crime concept with man in handcuffs
Global police operation takes down major cybercrime and hacking forums
sewage water treatment
Southern Water denies claims it offered $750,000 ransom to ransomware hackers
A close-up of an interent search bar with 'http://ww' visible
Major website hijacking scam sees over 35,000 sites attacked, redirected to gambling sites, so be on your guard
Latest in Security
Hacker silhouette working on a laptop with North Korean flag on the background
North Korea unveils new military unit targeting AI attacks
An image of network security icons for a network encircling a digital blue earth.
US government warns agencies to make sure their backups are safe from NAKIVO security issue
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
This top WordPress plugin could be hiding a worrying security flaw, so be on your guard
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
Veeam urges users to patch security issues which could allow backup hacks
UK Prime Minister Sir Kier Starmer
The UK releases timeline for migration to post-quantum cryptography
Representational image depecting cybersecurity protection
Cisco smart licensing system sees critical security flaws exploited
Latest in News
L-mount alliance
Sirui joins L-Mount Alliance to deliver its superb budget lenses for Leica, DJI, Sigma and Panasonic cameras
Security padlock and circuit board to protect data
Trust in digital services around the world sees a massive drop as security worries continue
Samuel and Romy standing very close together in A24's Babygirl movie
Everything new on Max in April 2025, including A24's Babygirl and The Last of Us season 2
An AMD Radeon RX 9070 XT made by Sapphire on a table with its retail packaging
AMD’s secret weapon against Nvidia seems to be stock – way more RX 9070 GPUs are rumored to be hitting shelves than RTX 5000 models
Hacker silhouette working on a laptop with North Korean flag on the background
North Korea unveils new military unit targeting AI attacks
Seth Milchick and Kier Eagan's animatronic speaking in Severance season 2 episode 10
Apple TV+ announces Severance has been renewed for season 3 after that devastating finale