.

David J. Shannon

Chair, Privacy and Data Security

Chair, Intellectual Property, Technology and Media Litigation

DJShannon@mdwcg.com

Portrait of David J. Shannon

Legal Updates for Privacy and Data Security

The MGM Data Breach: Hackers Leverage LinkedIn Data to Pull Off Sophisticated Social Engineering Attack

Legal Updates for Privacy and Data Security - September 15, 2023

September 15, 2023

by David J. Shannon

On September 11, 2023, MGM announced that it had been the victim of a sophisticated data breach attack. Reportedly, the hacking group Scattered Spider was able to shut down and paralyze a large part of MGM Resorts International’s computer systems. MGM operates over 30 hotel and casino gaming venues around the world. Caesar’s Entertainment has also allegedly been the victim of a similar attack in recent weeks and was forced to pay a ransom.

Scattered Spider is a relatively new hacking group that uses social engineering to trick employees to unwittingly provide login credentials or passwords to allow Scattered Spider to bypass security systems. Various reports indicate that Scattered Spider used the information from an MGM employee’s LinkedIn page to allow the hacking group to impersonate the individual and call MGM’s IT help desk. The help desk then reset passwords for the individual, which allowed Scattered Spider to gain access to the systems and then move laterally to deploy their sophisticated attack.  

This incident once again highlights that no matter how great a company’s security system is, human error can always lead to devastating losses for the business. MGM has reported losing tens of millions of dollars a day as a result of this attack and may be forced to pay a significant ransom. All businesses and their insurance carriers should use this incident to reinforce to their clients and employees that never-ending vigilance is needed to stop these types of hacking attacks. Insurers should be consistently questioning their insureds about what programs, policies, and procedures are being used to educate employees about social engineering tactics and events.   
 

 

Legal Updates for Privacy and Data Security, September 15, 2023, has been prepared for our readers by Marshall Dennehey. It is solely intended to provide information on recent legal developments and is not intended to provide legal advice for a specific situation or to create an attorney-client relationship. We welcome the opportunity to provide such legal assistance as you require on this and other subjects. If you receive the alerts in error, please send a note tamontemuro@mdwcg.com. ATTORNEY ADVERTISING pursuant to New York RPC 7.1. © 2023 Marshall Dennehey. All Rights Reserved.

Firm Highlights

Result

Summary Judgment Secured, Preserving $750,000 in Coverage for Insured in Major Trucking Liability Dispute

Ray Freudiger and Michael A. Roberts (both of Cincinnati) successfully obtained summary judgment on behalf of their client in a coverage dispute arising from a May 19, 2022, motor vehicle accident. A permissive driver operated a box truck for an interstate trucking company and caused severe injuries to two tort victims. Prior to the accident, the insured had procured a commercial auto policy for the trucking company with stated limits of $1,000,000. Following the accident, the insurer initiated a declaratory judgment action asserting that only reduced bodily injury limits of $25,000/$50,000 applied and later counterclaimed, alleging it would not have insured the driver had he been properly submitted for approval under the policy. After extensive discovery, briefing, and oral argument, the court rejected the insurer’s attempt to shift responsibility for the $750,000 in coverage it was legally required to provide for permissive drivers under Ohio law, granting summary judgment in favor of the insured and preserving $750,000 in liability exposure.

Thought Leadership

Fla. Workers' Comp Physician Dispensing Ruling Could Produce New Legislative Fight

In a significant decision issued on February 25, 2026, the First District Court of Appeal (DCA) ruled in Publix Super Markets, Inc., et al. v. Department of Financial Services, et al., 430 So. 3d 252 (Fla. 1st DCA 2026), that while injured workers have an absolute right to choose their own pharmacy or pharmacist, that right does not extend to physicians who dispense medications directly to their patients.  Read Blake's article in Insurance Journal: https://www.insurancejournal.com/news/southeast/2026/08/05/880229.htm. 

Portrait of Carolyn Schweizer, with text below: Philadelphia Office Managing Attorney

News

Marshall Dennehey Names Carolyn Schweizer New Philadelphia Office Managing Attorney

Jason Banonis Holds PDI Attorney of the Year Award with the PDI President

News

Jason Banonis Named Attorney of the Year by the Pennsylvania Defense Institute

blue facade of a hospital sign against blue sky

Result

Defense Verdict in Complex Medical Malpractice Trial

empty courtroom photo

Result

Summary Judgment Secured for Life Insurance Agent

Marshall Dennehey Announces 2026 Ohio Super Lawyers and Rising Stars

News

Marshall Dennehey Announces 2026 Ohio Super Lawyers and Rising Stars

Event

Pennsylvania Appellate Update 2025-2026

On August 21, 2026, Casey will serve as a panelist for the live webcast program, “Pennsylvania Appellate Update 2025-2026” presented by the Appellate Advocacy Committee of the Pennsylvania Bar Association and Pennsylvania Bar Institute. The program is divided into three parts—Criminal, Civil, and Administrative. Casey will serve as a panelist for the Civil portion, along with Christina McKinley of Blank Rome, Ben Baer of Injury Law Partners, John Masslon of Keller Postman, Jonathan Bruno of Bruno Litigation LLC, and moderator, Ezza Ahmed of Buchanan Ingersoll.  Registration and more information: https://www.pbi.org/product/pennsylvania-appellate-update-2025-2026/

Thought Leadership

A Unified, Single Claim for Damages Requires Apportionment in a Joint Proposal: What the Decision in 'Trace Elements' Means for Property Insurance Claims

Kimberly and Seth, shareholders in the Insurance Services Practice in our Fort Lauderdale office, break down the Florida Supreme Court's decision in 'Trace Elements v. MacKensen' and what it means for property insurance claims in the state. Read the article here.

Thought Leadership

Appellate Division Affirms Dismissal of Legal Malpractice Counterclaim Against Martin Law Firm

In Martin v. Loury, 2026 N.J. Super. Unpub. LEXIS 1617 (App. Div. July 15, 2026), Martin Law Firm represented Kirk Loury in an employment matter Mr. Loury filed against his former employer, Concord Equity Group Advisors LLC (“Concord”). The allegations included, among other things, that Loury was not fairly compensated for his employment with Concord. After a bench trial finding in Loury’s favor, the Appellate Division remanded this matter in February 2016 for a second trial. During the second trial, Concord CEO, Lee Argush, testified to lower compensation estimate than first trial. On remand, the second trial judge awarded Mr. Loury the same damages as the first judge, finding Mr. Argush not credible. After the findings during the second trial, Martin Law Firm filed an action against Mr. Loury to recover legal fees and costs of representing Mr. Loury in a second bench trial and Mr. Loury filed a counterclaim against Martin Law Firm for legal malpractice, alleging he should have received an even higher award in the second bench trial. In this allegation, Mr. Loury, through his expert, claimed that Martin Law Firm should have recalled Mr. Loury to the stand to rebut Mr. Argush’s testimony to allege an alternative theory of damages. Mr. Loury’s expert admitted that the second judge already rejected Mr. Argush's theory and accepted Loury's damages theory. The trial court barred Mr. Loury’s expert and dismissed Loury's counterclaim with prejudice before convening the collection trial, and the jury ruled in Martin Law Firm’s favor. Mr. Loury appealed the trial court's pretrial rulings barring his liability expert from testifying in support of his legal malpractice counterclaim, denying his motion for summary judgment on that counterclaim, and denying his motion to amend his counterclaim by adding attorney Joseph A. Martin as a codefendant. In affirming the trial court’s decision, the Appellate Division held that the trial court properly excluded Loury’s expert testimony in the counterclaim against Martin Law Firm because the expert could not explain how calling Loury as a rebuttal witness would have increased damages when the second judge already rejected Mr. Argush's testimony and accepted Loury's damages theory, making the expert’s causation opinion speculative. The Appellate Division also held that the trial court properly denied Mr. Loury's summary judgment motion on his malpractice counterclaim because reasonable minds could differ on whether Mr. Martin's alleged failures would have changed the second judge's damages award, given the judge already found Mr. Argush not credible, creating genuine factual disputes precluding summary judgment. Also, the Appellate Division held that the trial court properly denied Loury's May 2023 motion to add Joseph Martin individually because the statute of limitations expired in February 2022, six years after the 2016 appellate remand when Mr. Loury incurred new legal costs, and relation back did not apply because Mr. Loury knew Mr. Martin's identity throughout and strategically chose to sue only Martin Law Firm in his 2019 counterclaim.