MGM’s iconic resorts, with their synchronized fountains, sparkling casinos, and the buzz of risk and reward, exude confidence from the outside. However, beneath that radiance, a much less graceful tale was developing, one that eventually attracted millions of visitors. Two distinct cybersecurity attacks that had remarkably similar outcomes set off a series of events that MGM was unable to ignore.
Unauthorized access to MGM’s internal systems in 2019 constituted a quiet breach. There will be no drama or alarms—just a thoughtful download of private information. Many guests were not notified at the time. Names, emails, dates of birth, and official IDs were all secretly collected and trafficked on the dark web. Years went by. Then, in September 2023, MGM took another, louder blow. The company’s infrastructure was immobilized by a ransomware attack. Visitors were unable to check in. Slot machines froze. The system’s fragility was exposed when the digital glitz crumbled.
MGM Data Breach Settlement — Key Facts
| Category | Details |
|---|---|
| Settlement Amount | $45 million total |
| Covered Incidents | July 2019 data breach, September 2023 ransomware attack |
| Type of Data Compromised | Names, addresses, birthdates, SSNs, driver’s licenses, passport numbers |
| People Affected | Approximately 37 million individuals |
| Eligible Compensation | $75 for SSNs, $50 for driver’s license/passport, free ID protection |
| Court Status | Preliminary federal court approval in January 2025 |
| Claim Process Website | mgmdatasettlement.com |
| Affected MGM Properties | Aria, Bellagio, MGM Grand, Mandalay Bay, Beau Rivage, Borgata, and others |
MGM reached a $45 million settlement by the beginning of 2025. At first glance, the figure appeared remarkable. However, it became evident that this was more about procedure than compensation when split among the approximately 37 million affected visitors. The offer: $50 if your driver’s license or passport was taken, and $75 if your Social Security number was. Protection against identity theft was also included. Although these rewards were especially helpful to high-risk individuals, they hardly touched the surface for others.
This was a public reckoning for MGM. However, it was also a deliberate containment. When mgmdatasettlement.com, the official settlement website, first went live, it had an incredibly user-friendly layout that led visitors through the eligibility and claim procedures. It appeared to be designed to effectively restore trust. However, this was too late for many. The damage was already duplicated, disseminated, and made profitable in areas of the internet that the majority of us never visit by the time the second breach occurred.
The extent was astounding. There was more than one property involved. Almost every MGM brand you can think of—Mandalay Bay, Bellagio, Aria, Luxor, Beau Rivage, and even Borgata in Atlantic City—was impacted by the hack. Visitors from 2017 onward were drawn into a timeline they had not requested to be included in. The lingering anxiety of compromised identity now accompanied their memories of conferences, vacations, and short trips.
The plaintiffs contended that MGM had not put in place appropriate cybersecurity procedures through calculated legal means. Despite its apparent simplicity, the statement raised deeper questions about how large organizations handle their digital responsibility. Data stewardship frequently falls behind visual opulence, especially in the hotel sector, which is based on the client experience. Ignoring the vault’s cracks is like polishing the marble flooring.
I remember a tech leader talking about digital transformation for big hotels at a convention in 2022. He explained the conflict between providing a flawless service and keeping back-end systems safe. It’s a remarkably delicate balance. Until I read about how swiftly MGM’s front-of-house elegance crumbled under ransomware pressure, I didn’t give it any thought at the moment. Even now, I can still hear that memory.
Advocates for consumer protection have brought up important issues since the breaches. When millions of records are at risk, what does “reasonable” cybersecurity mean? Does multi-factor authentication apply here? Backups that are air-gapped? Or is it just the desire to invest in prevention before reputational collapse renders it inevitable?
The expense in this instance was not just monetary. It is difficult to measure the emotional toll on impacted visitors, especially those whose data has been misused. The name and birthdate of a single person might not seem like much. However, when paired with a stolen SSN and a compromised passport, it turns into an extremely useful toolset for identity thieves. Fraudulent tax returns and loans made in their names have already been reported by a few. Some people today suffer from the ongoing fear of being targeted, both in terms of when and if.
MGM’s decision to reach a settlement without acknowledging wrongdoing was a crucial step in restoring their reputation. Without subjecting it to years of judicial delays, it admitted injury. However, doubters still exist. Settlements can function as shields, enabling businesses to cover up missteps without altering their conduct, according to legal experts. The true inquiry is if this event changes MGM’s strategy for digital security or if it just marks the end of a chapter with a compensation.
Businesses like MGM can establish new benchmarks by incorporating stronger encryption systems, rotating internal audits, and open reporting procedures. Instead of following, they can decide to take the lead. This kind of change is about accountability as much as compliance. It’s an unspoken pledge that your most private information won’t be exchanged for ease.
The trail is very obvious for those who are unsure about what will happen next. Go to the settlement’s website. Send in your claim. Take note of your credit. Be careful. However, given the scope of the penetration, even such actions seem glaringly little.
The hospitality industry may witness significant advancements in data collection and storage in the years to come. Businesses will need to transition from reactive damage control to proactive protection as more customers expect transparency. In addition to a data leak, MGM’s reputational collapse revealed the serious consequences of low-priority cybersecurity.
