$45 Million MGM Settlement Resolves Data Breach Lawsuits Over 2019, 2023 Cyberattacks

New to ClassAction.org? Read our Newswire Disclaimer

MGM Resorts International has agreed to pay a $45 million settlement to resolve consolidated class action lawsuits over separate data breaches that occurred in July 2019 and September 2023.

Don’t miss the next class action settlement deadline. Sign up for ClassAction.org’s free weekly newsletter.

According to one lawsuit against MGM, the hospitality and gaming giant failed to prevent cybercriminals from hacking into its computer systems in July 2019 and downloading the personal data of millions of guests. Years later, in September 2023, unauthorized individuals were again able to access and lock down MGM’s network, another class action suit charged.

All told, the data breach lawsuits alleged that the private information of approximately 37 million MGM customers was compromised in the 2019 and 2023 cyberattacks.

The $45,000,000 data breach settlement, which was preliminarily approved by the court in late January 2025, covers anyone in the United States whose private information was accessed during the MGM data breaches.

To receive MGM settlement benefits, class members must submit a timely, valid claim form by mail or online through the official settlement website once it is launched.

ClassAction.org will update this page when the official MGM settlement website is established.

As part of the deal with MGM, eligible class members who file a valid claim form will be entitled to receive up to $15,000 per person in reimbursement for documented losses that are “fairly traceable” to either data breach, the settlement agreement says.

In addition, consumers can submit a claim to receive a flat cash payout based on whether they are a Tier 1, 2 or 3 class member, the agreement relays. Tier levels are determined by the type of data consumers had exposed in the incidents, the document notes.

Per the settlement agreement, Tier 1 class members—that is, those whose Social Security number or military identification number was compromised—will receive an estimated $75 payment per person.

Tier 2 class members—consumers whose passport or driver’s license number was exposed and who are not also in Tier 1—will be entitled to an estimated $50 payout per person, the agreement states.

Lastly, Tier 3 class members—those whose name, postal address and date of birth were compromised and who are not also in Tier 1 or 2—will receive an estimated $20 payment, the document explains.

The settlement agreement shares that consumers will be provided a unique identifier on their settlement notice—which, according to the preliminary approval order, will be issued within 30 days of January 21, 2025—that can be used on the official website to determine their tier level.

All MGM data breach settlement cash payouts will be subject to pro-rated adjustment depending on the total number of valid claims that are filed, the agreement adds.

Finally, as part of the MGM class action settlement, eligible class members may also submit a claim for one year of identity theft protection and credit monitoring services at no cost.

The parties now await a final approval hearing set for June 18, 2025, at which time United States District Judge Gloria M. Navarro will decide whether to ultimately approve the terms of the MGM deal. According to the settlement agreement, class members will have up until 15 days before that date to file a claim form for benefits.

Head to ClassAction.org’s settlements page for a complete list of data breach settlements.