Teen Turns Himself In After Series Of Alleged Hacks On Las Vegas Casinos

A teenage suspect surrendered to Las Vegas authorities Sept. 17 and faces charges in connection with cyber attacks on casinos, reportedly including one that cost MGM Resorts $100 million.

The juvenile turned himself in at the Clark County Juvenile Detention Center, according to a Las Vegas Metropolitan Police Department’s (LVMPD) press release. Police booked him on six charges, including three counts of obtaining and using personal information of another individual to cause harm or impersonate them. He was also charged with with count each of extortion, conspiracy to commit extortion and unlawful acts regarding computers.

The Clark County District Attorney’s Office wants to turn the juvenile over to the criminal division where he would be tried as an adult.

Las Vegas police said the suspect was connected to the targeting of multiple casino properties from August to October 2023 through “sophisticated network intrusions” linked to an alleged cyber group known as “Scattered Spider.” The group also operates under the names “Octo Tempest,” “UNC3944” and “Oktapus,” authorities said. (RELATED: Hackers Allegedly Shut Down MGM Resorts With One Stupefyingly Simple Trick)

The Las Vegas Metropolitan Police Department’s Cyber Investigative Group has arrested a teenager suspected of being involved in the 2023 ransomware cyberattacks on MGM Resorts and Caesars Entertainment casinos in Las Vegas.

The teenager reportedly turned himself in. pic.twitter.com/nq28z13VER

— Las Vegas Locally 🌴 (@LasVegasLocally) September 19, 2025

The FBI’s Las Vegas Cyber Task Force, which features the LVMPD Cyber Investigative Group, led the investigation. Police did not identify the suspect because he is a minor.

Hackers allegedly disabled hotel key cards and slot machines, blocked booking systems and locked employees out of email accounts, SF Gate reported. MGM Resorts disclosed in a Securities and Exchange Commission filing that a September 2023 breach cost the company approximately $100 million.

The method allegedly used proved surprisingly simple. They allegedly tracked an MGM employee on LinkedIn, impersonated them and called the company help desk requesting a password reset, Forbes reported. The alleged attackers gained system access within 10 minutes.

Caesars Palace reported a similar incident during the same period, according to SF Gate. The company’s SEC filing reportedly said the company took “steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result.

Cybersecurity professionals suggested to NBC News that this could mean the company paid those responsible.