MGM Lawsuit: The $45 Million Data Breach Settlement Has Paid Out — What Else Is Pending
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
If you are looking for the MGM data breach settlement: it is finished. The $45 million deal covering the July 2019 breach and the September 2023 cyberattack received final approval on June 18, 2025, the claim deadline was June 3, 2025, and payments for approved claims went out on December 12, 2025. There is nothing left to file. As of September 30, 2026, the other MGM cases in the headlines — a contract suit by the City of Springfield, state regulators' reviews of the 2023 attack, a withdrawn buyout offer, a BetMGM fine — do not pay hotel guests or casino customers.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Data Breach Lawsuits Said Happened
Two separate incidents, two separate lawsuits, one settlement. Per the settlement notice, MGM customer and guest data was accessed in or around July 2019, and again in or around September 2023. MGM's own annual report describes the 2023 attack: through unauthorized access to certain of its U.S. systems, criminal actors took customers' names, contact details, gender, dates of birth and driver's license numbers — and, for a limited number of customers, Social Security and passport numbers. The attack also led to system shutdowns that disrupted MGM's domestic properties.
The plaintiffs alleged MGM failed to use reasonable security to protect that information. MGM denies the claims and any wrongdoing, and no court ever ruled that it broke the law; the two cases were settled together.
Case Details
The data breach settlement. Judge Gloria M. Navarro of the U.S. District Court for the District of Nevada oversaw the combined settlement of In re MGM International Resorts Data Breach Litigation, No. 2:20-cv-00376 (the 2019 incident), and Tonya Owens, et al. v. MGM Resorts International, No. 2:23-cv-01480 (the 2023 incident). Her final approval order of June 18, 2025 certified a class of “all persons in the United States whose Private Information was accessed during the Data Incidents,” overruled the only objection as untimely, and awarded class counsel $13.5 million in fees plus $801,631.96 in costs out of the fund. Epiq Class Action & Claims Solutions was the administrator. MGM's annual report adds that the 2023 attack also drew consumer class actions in Canadian courts; the $45 million deal resolved the U.S. litigation.
MGM v. the FTC. After the 2023 attack the Federal Trade Commission issued a civil investigative demand. According to trade press, MGM petitioned to quash it, the FTC denied the petitions, and MGM sued the FTC in federal court in Washington, D.C., arguing the demand did not apply to casinos. The FTC in turn went to federal court in Nevada to press its investigation. On March 3, 2025, SBC Americas reported that, per filings in the District of Nevada, the FTC and MGM agreed to dismiss the FTC's Nevada lawsuit over its investigation.
Las Vegas hotel-room pricing. In Gibson v. Cendyn Group, LLC, No. 24-3576, Strip hotel guests alleged that hotels licensing the same Cendyn/Rainmaker revenue-management software inflated room rates. On August 15, 2025, the Ninth Circuit affirmed the dismissal of the Sherman Act claims with prejudice. MGM Resorts is not among the hotel defendants named in that opinion; The Cosmopolitan, which MGM operates today, appears there under Blackstone, its operator named in the case.
Status: Data Breach Settlement Paid, Other MGM Cases Pay Guests Nothing
Regulators. MGM's annual report for 2024 said it was under investigation by “state and federal regulators.” Its report for 2025, filed February 11, 2026, mentions only state regulators, and its quarterly report of July 29, 2026 still lists the “timing and outcome” of those state investigations as an uncertainty. A regulator's fine is paid to the state, not to guests.
Springfield. In early September 2026 the City of Springfield, Massachusetts, sued MGM Resorts International and Blue Tarp Redevelopment for breach of contract. According to local reporting, the city alleges MGM Springfield fell short of its host community agreement — commitments to employ 3,000 people, bring almost 3,000 slot and gaming machines and refurbish a building at 101 State St. It is a city-versus-company case with no class and nothing for visitors.
Shareholders. On June 1, 2026, IAC (now People Inc.), already a major MGM shareholder, proposed buying the rest of the company for $48.30 a share; it withdrew the proposal on September 23, 2026. Law firms have put out “investigation” press releases about the offer — those are law-firm announcements, not lawsuits. MGM's latest quarterly report describes its pending cases as mostly “routine matters incidental to its business.”
Who Was Covered by the MGM Data Breach Settlement
The class was everyone in the United States whose personal information was accessed in the 2019 or 2023 incident. Each class member was sent an email or mailed notice saying whether they qualified for a cash tier and which one.
If you filed a claim and were approved, your payment was sent December 12, 2025. If it never arrived, or a check expired, contact the administrator directly at info@MGMDataSettlement.com or 1-888-899-8358 — the FAQ on the official settlement website covers check reissues and problems with digital payments.
If you did not file by June 3, 2025, there is no payment for you, and unless you opted out by May 19, 2025, you are bound by the settlement: the claims it released cannot be brought again. That is the part of the notice many people skipped — “Do Nothing: Get no Settlement Class Member Benefits. Give up your legal rights.”
What the MGM Settlement Paid
Those figures were estimates: the settlement allowed every cash payment to be raised or cut pro rata depending on how many valid claims came in, and the same fund also paid the $13.5 million fee award and $801,631.96 in costs. We did not find the final per-tier amounts published on the official site. If you want to compare with other breach deals, our data breach settlement calculator shows typical ranges, and open class action settlements lists deals still taking claims.
MGM Lawsuit Timeline
- 1
July 2019 — First Data Incident
Per the settlement notice, MGM customer and guest data is accessed in or around July 2019. The resulting lawsuit, No. 2:20-cv-00376, lands in federal court in Nevada.
- 2
September 2023 — The Cyberattack
Criminal actors get into MGM's U.S. systems, taking names, contact details, dates of birth and driver's license numbers, plus Social Security and passport numbers for a limited number of customers. System shutdowns disrupt MGM's domestic properties.
- 3
February–March 2025 — Fund Paid, FTC Fight Dropped
Insurance carriers pay the $45 million into the settlement fund in February 2025. On March 3, 2025, trade press reports that MGM and the FTC agreed to dismiss the FTC's Nevada lawsuit over its investigation.
- 4
June 18, 2025 — Final Approval
After the June 3, 2025 claim deadline, Judge Gloria M. Navarro approves the settlement, overrules the single objection and awards class counsel $13.5 million in fees.
- 5
December 12, 2025 — Payments Sent
Approved cash payments go out by each claimant's chosen method. Credit-monitoring enrollment emails follow starting December 16, 2025.
- 6
September 2026 — New Headlines, No Guest Money
Springfield sues over MGM Springfield's host community agreement, and People Inc. withdraws its buyout proposal on September 23, 2026. Neither creates anything a guest can claim.
Three Things to Watch For
A finished settlement whose notices went to a nationwide class is a gift to imposters:
“Late” MGM data breach claims
The claim deadline passed on June 3, 2025 and payments went out December 12, 2025. A site or message inviting you to “file your MGM claim now” or charging a fee to “recover” an unclaimed payment is not the administrator. The only contacts are info@MGMDataSettlement.com and 1-888-899-8358.
Copycat payment-selection emails
The real settlement sent payment-selection emails from Digital Disbursements — its own FAQ addresses whether they are legitimate. That makes the format easy to copy. Do not enter bank details through a link in an email; go to the official settlement website yourself and check there.
A betting account you never opened
On March 25, 2026, Pennsylvania fined BetMGM $100,000 after finding its identity checks let four fraud rings open BetMGM and Borgata accounts with other people's personal information and fund them with stolen or fraudulently obtained payment methods. After a breach that exposed names, birthdates and license numbers, treat an unexpected sportsbook welcome email as a warning sign and contact the operator.
MGM Lawsuit — Questions People Actually Ask
Is there an MGM data breach settlement, and can I still file a claim?
There was, and no. The $45 million settlement covering the 2019 and 2023 breaches received final approval on June 18, 2025. The claim deadline was June 3, 2025, and payments for approved claims were sent December 12, 2025. Nothing is open today.
How much did the MGM settlement pay per person?
Estimated flat payments of $75 (Social Security or military ID number exposed), $50 (passport or driver's license) or $20 (name, address or birth date), or up to $15,000 for documented losses, plus one year of credit monitoring. All cash amounts could move up or down pro rata.
I filed a claim but never got paid. What now?
Contact the administrator, Epiq, at info@MGMDataSettlement.com or 1-888-899-8358. The official FAQ covers check reissues and problems with digital payments. Have your notice's Unique ID ready.
Is there a new MGM lawsuit in 2026?
Yes, but not one that pays guests. In September 2026 the City of Springfield sued MGM Resorts International and Blue Tarp Redevelopment over MGM Springfield's host community agreement. Securities law firms announced “investigations” after IAC (now People Inc.) proposed a $48.30-a-share buyout, which it withdrew on September 23, 2026 — announcements, not class actions.
Did the FTC sue MGM over the 2023 hack?
Not with a lawsuit over the hack itself. The FTC investigated through a civil investigative demand. The court fight that followed — MGM's suit against the FTC in Washington, D.C., and an FTC filing in Nevada to press the investigation — the FTC's Nevada lawsuit ended when both sides agreed to dismiss it, trade press reported on March 3, 2025; we did not find the outcome of MGM's D.C. suit. MGM's 2025 annual report lists only state regulator investigations.
Was MGM part of the Las Vegas hotel price-fixing lawsuit?
Not in the appeal. Gibson v. Cendyn Group accused Strip hotels of using the same pricing software to inflate room rates; the Ninth Circuit affirmed the dismissal on August 15, 2025, and MGM Resorts is not among the hotel defendants named in its opinion. For the rental-market version of this fight, which did produce a settlement, see our RealPage settlement page.
Is MGM Slots Live part of an MGM settlement?
No — that is a separate settlement with Playstudios, not MGM. White v. Playstudios US, LLC covers players of MGM Slots Live, myVEGAS, Pop! Slots and other Playstudios games in six states. The deadline to choose cash or to opt out is October 21, 2026, and the fairness hearing is November 10, 2026. Our myVEGAS settlement explainer has the details.
My data was in the MGM breach. What is still worth doing?
Freeze your credit at all three bureaus — free and reversible. Watch for new accounts you did not open, including betting accounts. If you enrolled in the settlement's credit monitoring from December 2025, note that it runs for one year. If your Social Security or passport number was exposed, that risk does not expire with the monitoring.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.