Your Help Desk Is Your Perimeter

M&E companies have high personnel turnover, distributed workforces across production/post-production/vendor sites, and executives and talent who are high-profile targets. A help desk that hasn't been trained to handle social engineering calls is a direct path to domain admin access. MGM's breach began with a phone call to the IT help desk — the attacker impersonated an employee, got a password reset, and had domain admin within 10 minutes. Caesars' breach started the same way: a third-party IT vendor technician was social-engineered by a caller claiming to be an authorized employee. For production-heavy companies, the help desk is also the interface with freelance crew, temp staff, and vendor personnel who need access to production systems on tight deadlines. The time pressure makes it easy to skip verification steps. PCI-DSS 4.0 Requirement 8.3 (MFA on all access to cardholder data) and Req. 12.10 (incident response planning) are exactly the controls that would have stopped both MGM and Caesars.

TPN (Trusted Partner Network) is an industry standard managed by the Movie Pictures Association (MPA) that assesses the security readiness of vendors in the film and television supply chain. TPN assessments cover 263+ controls across Organizational, Operational, Physical, and Technical security domains. As of September 2025, the shield tiers are: Blue (entry level), Silver (standard baseline), Gold (major studio requirement), and Gold Star (highest trust tier for crown-jewel content). Major studios — Disney, Warner Bros. Discovery, Universal, Sony Pictures, Paramount — require TPN Gold as a contractual condition for VFX, post-production, localization, and digital supply chain work. If you're a vendor working on any major studio production, TPN Gold is effectively mandatory. TPN assesses your security posture, but remediation is your responsibility — and many vendors discover critical gaps only when a studio audit arrives. SecurEveryone's Production Data Exfiltration drill specifically prepares VFX and post-production staff for TPN audit scenarios.

All 51 future-dated requirements in PCI-DSS v4.0 became mandatory on March 31, 2025 — there is no grace period. For M&E companies operating casino, hospitality, or entertainment venue properties, the scope is broad: POS terminals, property management systems (PMS), slot machine payment integrations, loyalty program databases, and any network segment that touches cardholder data all fall under full PCI-DSS scope. Key requirements: Requirement 8.3 mandates MFA for all access to cardholder data — exactly the control that MGM lacked when the attacker obtained a help desk credential. Requirement 11.6.1 requires integrity monitoring of payment page scripts, directly addressing JavaScript supply-chain attacks. Requirement 12.10 requires a formal incident response plan with tabletop testing — something Caesars executed (paid the ransom, filed SEC 8-K, notified 65M loyalty members), but most smaller M&E companies have no documented IR plan at all.

Yes. When a vendor's access to your environment results in a data breach, the notification obligation flows to you — not your vendor. California Civil Code §1798.29 and New York General Business Law §899-aa both require notification by the 'person or business' that owns the breached data, regardless of whether the breach originated through a third-party. Caesars' September 2023 breach involved a third-party IT vendor being social-engineered — yet Caesars bore the notification obligation to 65M loyalty members. For M&E companies, vendor notification obligations are especially acute because production companies typically work with dozens of vendors who have remote access to production networks, asset management systems, and content review platforms. The Caesars playbook — vendor compromise → credential exfiltration → notification → regulatory scrutiny — is the same pattern M&E companies face if they don't audit their vendor access controls and incident notification runbooks.

MGM refused to pay ALPHV/BlackCat's ransom demand and absorbed the operational costs of a 10-day system outage that crippled hotel check-in, room keys, POS systems, and slot machines across their Las Vegas properties. Estimated total cost: $100M+ in direct losses, revenue impact, remediation, and regulatory response — before any credit monitoring or litigation costs. Caesars paid approximately $15M to prevent the release of loyalty member data (65M records: names, driver's license numbers, SSNs). Both companies were hit by the same threat cluster within the same week. The difference was operational posture: MGM's systems were down and affecting guests; Caesars was facing a data release threat. Both responses carry enormous costs. The lesson isn't 'pay or don't pay' — it's that both outcomes cost tens or hundreds of millions of dollars, and both were preventable with the same set of controls: MFA on admin accounts, vendor access governance, and an incident response plan that had been tabletop-tested before the crisis.