A US hotel giant is preparing to pay a $45 million settlement to millions of customers affected by two massive data breaches.
MGM Resorts International has reached the settlement over two breaches that hit about 37 million people in July of 2019 and September of 2023.
The 2019 breach exposed sensitive data including names, addresses, phone numbers and dates of birth, raising widespread identity theft concerns.
The 2023 breach also leaked personal data and triggered major issues at the hotels, rendering guests’ digital room keys inoperable while crashing ATMs, slot machines, and check-in systems.
The settlement resolves a class-action lawsuit led by Tonya Owens, filed in US District Court of Nevada.
Eligible class members can claim up to $15,000 for documented losses or tiered cash payments of $75, $50, or $20 based on the type of data compromised, plus one year of financial monitoring.
MGM has settled without admitting fault.
Claims must be filed by June 3, 2025, and opt-out or objection deadlines are May 19, 2025.