MGM Resorts
Disclosed Sep 12, 20233 years agoConfirmed
Social engineering and ransomware attack disrupts MGM casinos and steals customer data
MGM Resorts shut down systems after a cyberattack in September 2023 that disrupted its Las Vegas properties. Its 8-K said attackers obtained personal data of customers who transacted before March 2019, including driver's license numbers and, for some, Social Security and passport numbers, and estimated a $100 million hit to quarterly results.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Sep 12, 2023 |
| Discovered | Sep 8, 2023 |
| Happened | Sep 8, 2023 |
| Attack | Ransomware |
| Data exposed | Names, Emails, Phone numbers, Addresses, Dates of birth, Government IDs, Social Security numbers |
| Sector | Hospitality · US |
| Status | Confirmed |
| Lawsuit or fine | $45M class action settlement covering the 2019 and 2023 breaches (preliminary approval 2025) |
Sources
| Source | |
|---|---|
| Notice letter filed with the Delaware DOJ: MGM Resortsattorneygeneral.delaware.gov · Official notice | Official notice |
| MGM Resorts confirms hackers stole customers' personal data during cyberattacktechcrunch.com · News | News |
| MGM Resorts International Form 8-K, October 5, 2023sec.gov · SEC filing | SEC filing |
| MGM will pay $45 million to settle data breach lawsuittheverge.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Sep 12, 2023 | |
| Delaware DOJresidents of DE | Oct 5, 2023 | 47,266 |
Other breaches at MGM Resorts
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed May 29, 2022May 29, 20224 years agoUnverified | May 29, 20224 years ago | Not stated | Tech | Unverified | 25Macct |
| Details of 10.6 million MGM hotel guests from 2019 breach posted on forumFeb 19, 20206 years agoHackingUnverified | Feb 19, 20206 years ago | Hacking | Hospitality | Unverified | 11M |
History of this record
- 2026-09-25 · lawsuit: empty to $45M class action settlement covering the 2019 and 2023 breaches (preliminary approval 2025) · seed source
- 2026-09-25 · sector: other to hospitality · seed source
- 2026-09-25 · attack: unknown to ransomware · seed source
- 2026-09-25 · data_types: ["names"] to ["names","emails","phone","addresses","dob","government-id","ssn"] · seed source
- 2026-09-25 · disclosed: 2023-10-05 to 2023-09-12 · seed source
- 2026-09-25 · summary: empty to MGM Resorts shut down systems after a cyberattack in September 2023 that disrupted its Las Vegas properties. Its 8-K said attackers obtained personal data of customers who transacted before March 2019, including driver's license numbers and · seed source
- 2026-09-25 · title: empty to Social engineering and ransomware attack disrupts MGM casinos and steals customer data · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Delaware DOJ), confirmed by Delaware DOJ. Record counts are as reported. Not legal advice.