A look at the MGM hack, carried out by Star Fraud group, part of the Com online community of teenagers from English-speaking countries that also spawned Lapsus$
Context & Ripple Effects
Earlier coverage linked the MGM incident to Scattered Spider and described help-desk calls used to obtain passwords, while later reporting characterized that group as young, native English-speaking operators behind MGM and dozens of other intrusions. This account instead places the attack in the Com community through Star Fraud, sharpening the question of how these overlapping labels relate.
The connection to the group previously linked to MGM and more than 52 hacks and to Lapsus$ matters because it frames MGM less as an isolated casino breach than as part of a recurring English-speaking cybercrime milieu.
First-order effects
- MGM’s breach attribution is reframed around Star Fraud and the Com community, rather than solely the Scattered Spider label used in earlier coverage.
- Security teams assessing the incident have added reason to examine the help-desk password-acquisition tactic reported in the initial coverage alongside the broader network of actors connected to the attack.
Second-order effects
- Other enterprises facing similar social-engineering exposure may treat help-desk identity verification as a priority control, since the reported technique can bypass defenses focused only on malware or network access.
- The overlap among Star Fraud, Scattered Spider, the Com, and Lapsus$ makes incident attribution more consequential: defenders and investigators must track relationships and tactics, not just a single group name.
Third-order effects
- If repeated intrusions continue to emerge from loosely connected online communities, cyber-risk management will shift further toward identity controls and behavioral detection rather than actor-name blocklists.
- The pattern points to a more networked cybercrime landscape in which membership and branding can be fluid, making public attribution less stable even when operational methods recur.
The trend: High-impact breaches are increasingly being understood through interconnected, socially engineered cybercrime networks rather than as the work of one fixed ransomware brand.