Identity for Gaming

The job identity does in gaming

Gaming identity has to be nearly invisible to players while protecting accounts that hold real money in skins, currencies, progression and, for casino operators, loyalty tiers and stored identity documents. It spans PC, console, mobile and web, often links to platform identities (Steam, PlayStation, Xbox), and increasingly handles age assurance and parental consent. Behind the game sit studios and resorts with large workforces, outsourced IT support and identity providers that run everything from build systems to hotel check-in.

Gaming accounts for 3 of the 123 incidents in the Identity Breach Database (2.4%): Electronic Arts in 2021, and MGM Resorts and Caesars Entertainment within days of each other in September 2023. The database classifies casino and resort operators under gaming. The sample is small, but the pattern is the sharpest of any industry: all 3 involved someone persuading IT support to help them.

The identity threat picture, from the incident record

A bought session cookie, then a help desk request. In June 2021 attackers told Motherboard they bought a stolen Slack session cookie for Electronic Arts for $10, used it to enter an EA Slack channel, then asked EA IT support for a multifactor authentication token to reach the corporate network. EA confirmed the outline. They claimed about 780 GB of source code and tools, including FIFA 21 and the Frostbite engine; EA said no player data was accessed. The techniques are session cookie theft and help desk social engineering.

A phone call to the help desk, then the identity provider. MGM Resorts announced a cybersecurity issue on 11 September 2023 that took down hotel, casino and booking systems for days. Reporting and the attackers' own statements describe a call to MGM's IT help desk impersonating an employee found on LinkedIn, followed by control of MGM's Okta super administrator accounts and ransomware on ESXi hosts. MGM's 8-K estimated about $100 million of negative impact to Adjusted Property EBITDAR for September plus under $10 million of one-time costs, and MGM later agreed a $45 million class action settlement covering this attack and a 2019 breach. The flaw was the reset process, not the identity product.

An outsourced help desk. Caesars Entertainment disclosed on 14 September 2023 that social engineering of an outsourced IT support vendor gave an attacker network access, and that its loyalty program database had been taken, including driver's license or Social Security numbers for a significant number of members. Reuters and researchers reported Scattered Spider was behind it. Both casino cases are analyzed in the Scattered Spider help desk teardown.

MFA status. MFA was present and bypassed in 2 of the 3 (EA and MGM) and unknown at Caesars. None of the records describes a factor being cracked: the attackers replayed a session or got support staff to act for them. The same playbook hit Okta customers in other industries, recorded as help desk resets of Okta super administrator MFA.

Player-side threats. The database records breaches of companies, so player account takeover through credential stuffing, phishing of high-value accounts and resale of stolen items does not appear as incidents here. It is still the daily volume problem for player identity teams.

The regulatory floor

• COPPA applies whenever children under 13 play. The amended Rule, with a compliance date of 22 April 2026, updated verifiable parental consent methods (including government ID with facial match), added biometric identifiers to personal information and requires a written security program.
• Australia's Children's Online Privacy Code must be registered by December 2026, and India's DPDP Act requires verifiable consent for children's data from May 2027. See age verification.
• GDPR and CCPA/CPRA govern player data; CCPA's first cybersecurity audits, which assess MFA and privileged accounts, are due 1 April 2028 for the largest businesses.
• PCI DSS covers in-game and resort payments; see identity controls for PCI DSS.
• US casinos with more than $1 million in gross annual gaming revenue are financial institutions under Bank Secrecy Act regulations (31 CFR 1010.100(t)(5)), with AML and customer identification duties, and listed operators disclose material incidents on Form 8-K, as MGM and Caesars did.

The identity controls that matter most

1. Help desk resets that a caller cannot talk past. Resets of passwords and MFA, above all for privileged accounts, need verification that cannot be satisfied with details found on LinkedIn or in a breach: a live ID check with liveness, a callback to a registered device, or manager approval. Apply the same standard to outsourced support. See account recovery and vishing.
2. Phishing-resistant MFA and protected roles for identity provider admins. Super administrator accounts should require FIDO2 keys, be few, and use just-in-time elevation, with break-glass accounts held offline.
3. Alerting on privileged resets and new MFA enrollments. A reset followed by a new factor and admin activity within minutes is the signature of these attacks. See identity threat detection and response.
4. Sessions bound to managed devices. EA's attackers replayed a $10 cookie. Device-bound session credentials and conditional access on collaboration tools make a stolen cookie worthless.
5. Passkeys and step-up for players. Passkeys cut stuffing and phishing, and step-up authentication at trades, purchases and item transfers protects in-game economies.
6. Privacy-preserving age assurance. Use estimation or verified credentials that prove an age band without storing documents you then have to protect.

Vendor categories and named vendors

• Player CIAM: Stytch for API-first passwordless login, Auth0 for broad CIAM, Amazon Cognito for AWS-native studios.
• Fraud and bot signals: SEON for digital-footprint and device signals at signup and trades.
• Age assurance: Yoti for age estimation and reusable digital ID, and Veriff for document-based checks.
• Help desk and recovery verification: HYPR for phishing-resistant login with verified recovery, and Microsoft Entra Verified ID for replacing help desk proofing calls with a credential presentation.
• Workforce identity and admin protection: Okta with Yubico keys on admin roles, and CrowdStrike Falcon Identity Protection or other ITDR tools for detecting reset-then-escalate sequences.

The fuller shortlist is in best identity tools for gaming, with background in identity for gaming.

Common pitfalls

• Hardening login while the help desk can reset any account after a convincing phone call.
• Holding outsourced IT support to a weaker verification standard than in-house staff.
• Standing super administrator rights on the identity provider.
• Ignoring item and currency theft until players churn.
• Bolting on age verification in a way that harms privacy or experience.

Where it is heading

Passkeys will become the default for valuable player accounts, age assurance will expand under children's privacy codes, and after MGM and Caesars, verified help desk resets are becoming a board-level control for resort and casino operators.

Frequently asked questions

How were MGM Resorts and Caesars breached?

Both through social engineering of IT support in September 2023: MGM's own help desk, by a caller impersonating an employee, and Caesars' outsourced IT support vendor. Both attacks were attributed to Scattered Spider.

Did MFA fail at MGM?

MFA was bypassed rather than broken: the help desk could reset privileged credentials without strong verification, so the attacker obtained working factors. Hardened reset procedures and phishing-resistant MFA on identity provider admins are the controls.

What identity rules apply to games played by children?

COPPA in the US, with amended rules in force since April 2026, plus GDPR, Australia's forthcoming Children's Online Privacy Code and India's DPDP rules on children's consent from May 2027.