How One Phone Call Cost MGM $100 Million

In September 2023, one of the largest casino and hospitality companies on Earth was brought to a standstill — not by malware, not by a state-sponsored strike, but by a single phone call to an IT help desk.This is the full story of how Scattered Spider exploited the gap between trust and verification — from a LinkedIn search to a rogue Identity Provider inside MGM's Azure AD tenant — and how a $100M containment decision brought the casino floor dark.Zero Day Logs is an investigative audio documentary built entirely from the public record: SEC filings, court documents, government advisories, and verified forensic findings. Every breach. One episode. Real consequences.Find full technical breakdowns, attack timelines, and defensive configurations at zerodaylogs.com. If you found this breakdown valuable, please follow the show and leave a review.━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━CHAPTERS 00:00 Cold Open — Las Vegas Goes Dark 00:19 The Casino Floor Stops 01:38 The Help Desk: Where It All Started 03:42 OSINT — They Opened LinkedIn 04:43 Vishing: The Phone Call 05:47 Inside Okta — The MFA Reset 06:12 How Multi-Factor Authentication Works 09:49 Lateral Movement — Mapping the Network 11:53 Federated Identity Explained 16:10 SAML Assertion Forgery 18:25 The ESXi Architecture 20:08 MGM Pulls the Plug 20:48 What One MFA Reset Actually Cost━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━SOURCES & FURTHER READINGOkta Security Advisory (2023)CISA Advisory AA23-320AMGM SEC 8-K filing, September 2023Microsoft DART case study