F500 Entertainment & Leisure · Hotels, Casinos, Resorts · Private litigation
MGM Resorts International
Headline
Two separate major breaches, now settled - and the 2023 incident is the most instructive social-engineering case in this tracker after the Salesforce campaign…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Two separate major breaches, now settled - and the 2023 incident is the most instructive social-engineering case in this tracker after the Salesforce campaign: attackers reportedly used publicly available employee information and a phone call to a help desk to obtain access, taking down slot machines, hotel key cards, reservation systems and ATMs across MGM properties. Casinos also hold an unusually sensitive dataset - loyalty programmes track gambling volume and patterns, which is financial-behaviour data with obvious potential for harm to people with gambling problems.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; no sources are on file yet, so no legal tier is assigned.
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual guest/loyalty-program agreements, separate from this specific completed settlement.
Data sharing
TWO SEPARATE MAJOR BREACHES, NOW FULLY SETTLED: (1) A 2019 breach exposed personal information of approximately 10.6 MILLION guests — including celebrities and business leaders — with stolen data later appearing on public hacking forums. (2) A SEPARATE, more disruptive September 2023 attack (attributed to hackers connected with the ALPHV/BlackCat ransomware gang, which claimed responsibility, and widely reported to involve the Scattered Spider group — which BleepingComputer reported in July 2025 is believed to be linked to 2025 attacks on WestJet, Hawaiian Airlines, Erie Insurance and Aflac, with its role in the Qantas breach unclear; see those rows) encrypted portions of MGM's data infrastructure via ransomware, disrupting hotel reservations, slot machines, and payment processing across MGM's Las Vegas properties (Bellagio, Mandalay Bay, MGM Grand, Aria, Cosmopolitan, Vdara) for DAYS. Both incidents were consolidated into ONE federal class action, resulting in a $45 MILLION SETTLEMENT (final approval June 18, 2025; per the settlement website, payments for approved cash claims were sent December 12, 2025) — offering reimbursement up to $15,000 for documented losses plus one year of financial-account monitoring. Notably, MGM REFUSED to pay the 2023 ransom demand (unlike Caesars, this same tab, which reportedly did pay) — plaintiffs argue MGM's refusal, despite advance industry warnings about the same threat actor targeting Caesars weeks earlier, directly contributed to the customer data exposure that followed.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy mgmresorts.com/en/privacy-policy.html | Not fetched yet | NO (HTML only) |
| Terms of service mgmresorts.com/en/terms-of-use.html | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.