MGM Resorts

Disclosed Sep 12, 2023Confirmed

Social engineering and ransomware attack disrupts MGM casinos and steals customer data

MGM Resorts shut down systems after a cyberattack in September 2023 that disrupted its Las Vegas properties. Its 8-K said attackers obtained personal data of customers who transacted before March 2019, including driver's license numbers and, for some, Social Security and passport numbers, and estimated a $100 million hit to quarterly results.

What is known

People affected	Not stated in the sources we have
Disclosed	Sep 12, 2023
Discovered	Sep 8, 2023
Happened	Sep 8, 2023
Attack	Ransomware
Data exposed	NamesEmailsPhone numbersAddressesDates of birthGovernment IDsSocial Security numbers
Sector	Hospitality · US
Status	Confirmed
Lawsuit or fine	$45M class action settlement covering the 2019 and 2023 breaches (preliminary approval 2025)

Sources

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: MGM Resorts

Newstechcrunch.com

MGM Resorts confirms hackers stole customers' personal data during cyberattack

SEC filingsec.gov

MGM Resorts International Form 8-K, October 5, 2023

Newstheverge.com

MGM will pay $45 million to settle data breach lawsuit

Notices filed

TotalSep 12, 2023

ResearchCount not stated

Residents of DEOct 5, 2023

Delaware DOJ47,266 people

Other breaches at MGM Resorts

Breach, details not statedExposed dates of birth, emails, names, phone numbers and addresses.25M accountsTechUSUnverifiedMay 29, 2022 Details of 10.6 million MGM hotel guests from 2019 breach posted on forumHacking exposed dates of birth, emails, names, phone numbers and addresses.Hacking11M affectedHospitalityUSUnverifiedFeb 19, 2020

History of this record

lawsuit2026-09-25

empty to $45M class action settlement covering the 2019 and 2023 breaches (preliminary approval 2025)by seedSource

sector2026-09-25

other to hospitalityby seedSource

attack2026-09-25

unknown to ransomwareby seedSource

data_types2026-09-25

["names"] to ["names","emails","phone","addresses","dob","government-id","ssn"]by seedSource

disclosed2026-09-25

2023-10-05 to 2023-09-12by seedSource

summary2026-09-25

empty to MGM Resorts shut down systems after a cyberattack in September 2023 that disrupted its Las Vegas properties. Its 8-K said attackers obtained personal data of customers who transacted before March 2019, including driver's license numbers andby seedSource

title2026-09-25

empty to Social engineering and ransomware attack disrupts MGM casinos and steals customer databy seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Delaware DOJ), confirmed by Delaware DOJ. Record counts are as reported. Not legal advice.

Everything about MGM Resorts