MGM Resorts to Settle Data Breach Lawsuits for $45 Million

MGM Resorts International has agreed to pay $45 million to settle a class action lawsuit stemming from two major data breaches that affected millions of its customers. The settlement follows a high-profile cyberattack in 2023, alongside a prior breach in 2019. The U.S. District Court of Nevada has granted preliminary approval for the settlement, which is expected to address claims related to both incidents.
Background of the Breaches and Lawsuit

MGM's First Breach

MGM’s first major breach occurred in 2019, when hackers gained access to the personal data of approximately 37 million hotel guests. This data included sensitive information such as names, addresses, and passport numbers. In the wake of this breach, MGM faced multiple class action lawsuits. Despite this, the legal process dragged on for years, with the 2019 lawsuit eventually being combined with claims from the 2023 incident.

In September 2023, MGM faced a far more disruptive breach. Hackers impersonated an IT administrator to access the company’s internal network, freezing systems and causing widespread disruption. The attack compromised the data of another 37 million customers, this time including additional personal details such as Social Security numbers and military IDs. The breach gained significant media attention after it caused chaos in MGM’s hotels, with casino slot machines going offline and check-in processes grinding to a halt.

Despite the severity of the 2023 hack, MGM’s online gambling platform, BetMGM, was not impacted by either of the breaches. In addition to the cyberattack’s operational disruption, the company faced significant financial losses. MGM estimated that the 2023 breach alone cost the company $100 million, according to local reports. The resulting class action lawsuits sought to hold MGM accountable for the breach and demand compensation for affected customers.

As part of the settlement, victims of the breach may receive payouts of up to $15,000 depending on the severity of their personal losses. Smaller payments ranging from $20 to $75 will be distributed based on the extent of each victim’s damages. Additionally, MGM is offering affected individuals free identity protection services, including credit monitoring and $1 million in fraud protection coverage for one year.
MGM’s Response and Future Considerations

Following the 2023 breach, MGM’s CEO Bill Hornbuckle publicly apologized for the attack, expressing gratitude for the company’s employees and customers. He also outlined MGM’s efforts to mitigate the breach’s impact, including providing identity protection services to affected customers.

On behalf of everyone at MGM Resorts, I wish to also thank our customers for their loyalty and patience as we worked through this complex matter. We regret this outcome and sincerely apologize to those impacted. Your trust is paramount to us.

Conclusions and the Future

As the legal process moves forward, the court will hold a final approval hearing to review key aspects of the settlement. This includes determining whether the settlement is fair, reasonable, and adequate, and whether MGM should be required to pay plaintiffs’ attorney fees. Any new issues that arise before the final hearing will also be addressed, with the case potentially being dismissed once approval is granted.
Conclusion

The proposed $45 million settlement marks a significant step in resolving the class action lawsuits stemming from MGM’s data breaches. While the financial impact on the company is substantial, the settlement offers a measure of compensation and protection for those affected. As the court prepares for its final approval hearing, the broader implications for data security and corporate responsibility remain at the forefront of public concern, highlighting the growing need for stronger protections against cyberattacks in the hospitality industry.