MGM Resorts to pay $45M to settle data breach lawsuit

MGM Resorts (MGM) has agreed to pay $45M to settle a lawsuit over data breaches that exposed the personal information of 37 million customers. The case consolidated 22 class-action lawsuits filed over two security incidents: a data breach in 2019, and a ransomware attack in 2023. Lawyers for the victims said in district court filings that both data breaches saw hackers access MGM’s systems and obtain identifiable customer data, including names, addresses, phone numbers, email addresses, dates of birth, and passport numbers. Further information was also stolen in the 2023 ransomware attack that shut down Las Vegas slot machines and ATMs, including driver’s license numbers, military ID numbers, and Social Security numbers. A federal court has granted preliminary approval on the settlement, with a final hearing set to take place on June 18.