MGM Facing Class Action Over 10-Day Cyberattack in September 2023 [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims negligence on the part of MGM Resorts International is to blame for a September 2023 cyberattack that reportedly resulted in a 10-day shutdown of the company’s computer systems.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the 46-page lawsuit, unauthorized actors infiltrated MGM’s network on September 7 of this year by “impersonating an IT [administrator] and gaining access credentials.” Once inside the defendant’s system, the cybercriminals “locked down” the network and demanded MGM pay ransom, the suit relays.

Per the case, the ransomware attack lasted at least 10 days, during which MGM was forced to shut down computer systems across its properties, preventing consumers and resort guests from using electronic room keycards, Wi-Fi, ATMs, electronic gaming devices and other services.

Two notorious cybercriminal groups—Scattered Spider and ALPHV—have purportedly taken credit for the attack on MGM’s network and the theft of at least six terabytes of data from its stored files, the complaint explains. The filing shares that the ransomware attack compromised the information of MGM customers and MGM Rewards loyalty program members and included data such as full names, dates of birth, addresses, email addresses, phone numbers, Social Security numbers and/or driver’s license numbers.

The lawsuit argues that MGM, one of the top casino and hotel operators worldwide, “negligently” failed to implement adequate cybersecurity protocols to safeguard consumers’ data, which it allegedly stored unencrypted and unredacted in its network.

What’s more, the suit contends that MGM should have been well aware of the “foreseeable” threat, given that its IT vendor, Okta, had previously warned of this kind of ransomware attack and a high-profile subsidiary, BetMGM, had experienced a data breach in 2022.

However, despite the warnings, the defendant failed to take reasonable data security measures to protect customers’ private information from unauthorized disclosure, the case alleges.

The lawsuit looks to represent anyone in the United States whose personal information was disclosed in the MGM data breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.