The Nevada District has approved MGM’s $45m settlement to settle a class action lawsuit resulting from two data breach incidents in 2019 and 2023.
The Nevada District has approved MGM’s $45m settlement to settle a class action lawsuit resulting from two data breach incidents in 2019 and 2023.
Under the deal, MGM will pay tiered financial compensation to affected customers according to the seriousness of the leaked information.
The settlement marks the end of the multi-year litigation following the incidents, which led to an $100m EBITDA hit and widespread disruption at the group’s properties.
The court’s order said: “To avoid the risk and expense of litigation, the Parties agreed to a global settlement to resolve Plaintiffs’ claims for both Data Incidents on a class wide basis.
“As demonstrated below, the Settlement provides significant relief for the Settlement Class, including a non-reversionary all cash $45,000,000.00 Settlement Fund and valuable non-monetary relief.”
The hacks resulted in the leaking of tens of millions of customers private information including social security, military identification, phone and passport numbers.
The plaintiffs had alleged the breaches resulted from MGM’s failure to implement data security measures, monitor cloud-based servers and delete old data.
The plaintiffs in cases involving both incidents agreed in July 2024 to enter into mediation with an experienced data breach mediator.
MGM settles data breach class actions
After several weeks of negotiation, they came to an agreement with MGM and filed a notice of settlement with the court in October 2024.
Under the terms of the deal, people who were able to prove harms related to the hacks would be able to claim up to $15,000 from the fund.
Individuals who had their social security or military identification numbers leaked would be entitled to $75 compensation, with $50 set aside for those with affected driving licence numbers.
Despite the resolution to the class action complaints, MGM is separately dealing with an FTC probe into the company’s compliance with data security rules.
The Las Vegas-tentpole has countersued, alleging the investigation is personally motivated by the FTC chair’s stay at an MGM property during the incident.