Login
iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Powered by MOMENTUMMEDIA
Over a dozen class action lawsuits faced by casino and hotel giant MGM Resorts following two cyber attacks are being settled after the company agreed to a US$45 million payout.
MGM suffered the first of the two cyber attacks in 2019, exposing the personal data of up to 10.6 million customers. Data included names, emails, phone numbers and birth dates.
While MGM said it would bolster its cyber defences, the casino giant was breached a second time in 2023 after Scattered Spider, a subsidiary of the ALPHV ransomware gang, gained access to its network through vishing (voice phishing) before harvesting legitimate credentials from the company’s Okta Agent environment, before encrypting the network and exfiltrating data.
The incident caused disruptions and outages for weeks across the company’s casinos, costing it over US$100 million in damages.
According to class action lawyers, the two incidents affected over 37 million MGM customers, a number that has not been confirmed by the company.
According to a recent court filing, MGM agreed to a settlement of US$45 million on 21 January.
Of the US$45 million, 30 per cent will cover legal fees, while class action members can receive as much as US$75 each, depending on the data that had been stolen from them.
The settlement is set to be ruled on by a Las Vegas federal court on 18 June.
Rival casino giant Caesars Entertainment suffered a cyber incident at the same time as MGM, also as a result of the third-party attack on Okta by Scattered Spider.
Like the MGM class actions, some of the lawsuits faced by Caesars claim that the company did not adequately disclose the breaches to its customers and left them vulnerable to other potential risks.
They also suggest that the companies failed to properly secure the data of their customers and put them at risk of identity theft.
One lawsuit, representing an Illinois couple that had been members of the Caesars Rewards Program for over two decades, claimed a breach of contract with every customer whose personal data was compromised in the breach.
Be the first to hear the latest developments in the cyber industry.
