Court Approves $45M Settlement in MGM Resorts Hack Class Action

Court Approves $45M Settlement in MGM Resorts Hack Class Action

The United States District Court for the District of Nevada gave preliminary approval for a $45 million settlement in a class action lawsuit filed against MGM Resorts International (NYSE: MGM) due to the September 2023 cyber breach that temporarily disabled the casino operator. 

The lawsuit also encompasses allegations from plaintiffs whose personal information was breached in a cyber incident that affected the gaming company in July 2019. Plaintiffs' counsel claimed that MGM was negligent in its cybersecurity measures, leaving customers’ personal information exposed in both cyber incidents.

"The settlement includes significant financial relief for impacted plaintiffs. Class members whose social security number or military identification number were exposed are eligible for a $75 cash payment and those whose passport number or driver’s license were exposed are eligible for a $50 payment,” according to Cohen Milstein Sellers & Toll PLLC, the firm that handled the case. “In addition, all settlement class members may elect identity theft protection and credit monitoring.”

The assertion that MGM's cybersecurity was inadequate might have had some validity. BitSight, a company specializing in cybersecurity ratings and analytics, assigned an “F” cybersecurity grade to the gaming firm before the hack in September 2023. 

MGM Cyber Issues 

The attack in September 2023, carried out by a hacker group called “Scattered Spider,” marked another occasion when MGM faced a cyber intrusion. 

In February 2020, it was disclosed that hackers had stolen sensitive information of 10.6 million MGM customers, including certain celebrities, from the company's database in 2019, subsequently selling that data for profit on the dark web. In December 2022, BetMGM, which is 50% owned by MGM, acknowledged a data breach that was thought to have taken place in May 2022. 

“The hotel and entertainment industries are particularly desirable targets for hackers,” said Douglas McNamara, co-lead interim class counsel and partner at Cohen Milstein.

He is also a co-lead class counsel in a similar class action lawsuit against Caesars Entertainment (NASDAQ: CZR), which was similarly affected by Scattered Spider in 2023. Reports indicated that Caesars compensated the hacking group with up to $30 million to back off — a tactic not used by MGM. The Bellagio operator adhered to FBI guidelines by refusing to give in to the hackers, yet it incurred $100 million in losses and faced $10 million in one-time expenses linked to the attack. 

Graduated Compensation for MGM Hack Affected Individuals 

A report from the United States District Court for the District of Nevada shows that victims of the two ransomware incidents at MGM will be divided into three levels, receiving cash payments between $20 and $75. 

In certain severe situations, victims might qualify for compensation up to $15,000 if they can provide proof of being victims of identity theft, associated legal expenses, and credit repair costs, among other items. 

“All Settlement Class Members may submit a Claim Form for a Documented Loss Cash Payment for up to $15,000.00 per Settlement Class Member upon presentment of documented losses fairly traceable to either Data Incident and attest under penalty of perjury to incurring documented losses, supported by reasonable documentation,” according to the court filing.