The 2019 breach involved the theft of sensitive customer information, including driver’s license numbers, passport numbers, and residential addresses. The more recent September 2023 incident involved a ransomware attack that not only compromised customer data but also disabled critical hotel and gaming systems, resulting in estimated losses of $100 million for the company.
Under the settlement terms, affected individuals whose social security numbers or military IDs were exposed may claim up to $75 in compensation. Those whose passport or driver’s license information was compromised are eligible for up to $50. All affected customers will receive access to identity theft protection and credit monitoring services.
The case, handled by prominent law firms including Cohen Milstein, Berger Montague, and Hausfeld, alleged that MGM failed to implement adequate data security measures. This settlement follows recent guidance from the NSA and CISA emphasizing the importance of robust identity and access management practices to prevent such breaches.
MGM Resorts has declined to comment on the settlement terms. The agreement covers individuals affected by either of the two data breaches, with the total number of impacted customers reaching approximately 37 million people.
The settlement highlights the growing financial and reputational risks organizations face from data breaches, particularly those handling large volumes of personal information in the hospitality sector.
Source: JD Supra
–
February 3, 2025 – by the ID Tech Editorial Team
