MGM Resorts customers who were affected by data breaches in 2019 and 2023 should soon be eligible for a portion of a $45 million settlement stemming from a class action against the company. The US District Court of Nevada granted preliminary approval to the settlement earlier this week. If you’re among the affected parties, you’ll find more information on how to submit a claim below.
According to the consolidated complaint filed in the US District Court of Nevada, hackers broke into the resort and casino operator’s systems twice.
First, in 2019, a hacker stole sensitive data, including driver’s license numbers, passport numbers, and customer addresses. In September 2023, the second instance involved a ransomware attack that disabled MGM’s systems—including hotel access and gaming systems—for several days. Per the lawsuit, hackers again accessed sensitive customer information.
The complaint alleges that MGM’s failure to implement sufficient data security measures resulted in the attacks affecting an estimated 37 million people. Before the proposed settlement, the company estimated the financial impact from the second attack alone was approximately $100 million. In an October 2023 filing with the US Securities and Exchange Commission, MGM indicated insurance would likely cover the costs.
In 2023, the hackers also targeted Caesars Entertainment. However, Caesars opted to pay $15 million in ransom, which limited the breach’s business impact.
The breaches did not affect BetMGM, a joint online casino and sports betting venture between MGM Resorts and Entain.
Settlement provides impact-based compensation
According to the order granting preliminary approval of the settlement, the agreement would provide tiered compensation for victims of the breaches based on the type of information stolen.
As the Wall Street Journal (WSJ) detailed, those whose Social Security or military ID numbers were stolen will receive $75, equivalent to Tier 1 in the settlement document. Tier 2 members—whose passport and driver’s license numbers were compromised—will receive $50, while Tier 3 members, presumably all others, will receive $20.
All class members are eligible for one year of complimentary financial account monitoring and at least $1,000,000 of fraud/identity theft insurance.
In addition to tiered payouts, any class member with proof of specific harm can seek a Documented Loss Cash Payment of up to $15,000. Named plaintiffs deposed in the 2019 action will be eligible for a service award of $10,000, while all others can request $3,500. The class council may apply for an award of up to 30% of the settlement fund to cover attorney’s fees plus reimbursement of any costs as part of the Motion for Final Approval.
Per the WSJ, the court’s final signoff on the agreed-to settlement is on track for June.
Class members will receive notification on strict timelines
In the meantime, within 10 days of the settlement’s preliminary approval, MGM must provide a class list to the proposed settlement administrator—Epiq Class Action & Claims Solutions. The list should contain, if available, class members’ names, email addresses, postal addresses, and telephone numbers.
Within 30 days of the same approval, Epiq will initiate a publication notice online and via select social media platforms.
The notice must include the general terms of the settlement, plus:
- Directions on how to submit a claim form
- The claim form deadline
- The opt-out deadline (to be excluded from the class)
- The objection deadline (to object to the settlement, attorney’s fees, or service awards)
- The final hearing date
- The settlement website
Epiq will also notify all class members via the emails provided by MGM. In the case of bounce-backs or unknown emails, Epiq will send notices via postcards by US mail. This notification must occur at least 60 days before the final approval hearing.
Epiq will also post the settlement notice on the accompanying website and make the long form available by mail at least 45 days before the hearing. In addition to the notice, the settlement website must provide key documents, dates, and answers to frequently asked questions.
A toll-free telephone number will also allow class members to get answers to questions and request a more detailed notice.
Submitting a settlement claim
Class members must submit an accurate and timely claim form by the selected deadline to receive settlement benefits. Forms will be available via the website or by mail.
Likewise, members can submit completed forms through the settlement website or via the US postal service. Epiq will then review all claims to determine validity, eligibility, and the type and amount of cash payment required. If Epiq denies a claim, class members can update or refile it before the claim deadline.
Cash payments will be made to members with valid claims via electronic payment or paper check no later than 75 days after the settlement is finalized.
About the Author
