MGM Resorts $45 million data breach settlement: What Was Paid, Who Was Covered, Status

MGM Resorts agreed to pay USD 45 million to settle class actions over its July 2019 data breach and its September 2023 cyberattack, and the claim window closed on June 3, 2025.

The case sits before Judge Gloria M. Navarro in the U.S. District Court for the District of Nevada. It is the largest casino data-breach settlement we track.

The USD 45 million is a gross fund before fees and costs, and estimated flat payments were about USD 75, USD 50 or USD 20 by the type of data exposed.

Final approval on June 18, 2025 and payments from December 12, 2025 come from one secondary source only, so this page marks them that way.

How we source and check every case: methodology.

What this case is about

Owens et al. v. MGM Resorts International, 2:23-cv-01480-GMN-NJK, and In re MGM Resorts International Data Breach Litigation, 2:20-cv-00376-GMN-NJK, are two dockets in the District of Nevada that were settled together. A complaint states one side's allegations, and only the court's orders decide anything.

The 2019 breach and the September 2023 cyberattack

The 2019 breach exposed about 10.6 million guest records later posted on hacking forums, and the September 2023 Scattered Spider ransomware attack took MGM's Strip systems down for ten days. The first suit, 2:20-cv-00376, was filed in February 2020. The Owens suit over the 2023 attack, 2:23-cv-01480, followed.

The 2023 attack hit MGM's resort systems, not only its gambling operations. That is why the case belongs with other casino and sportsbook data breach lawsuits, where a gambling company's handling of guest and player data is the subject.

What the complaints alleged

The consolidated complaints alleged negligence, breach of implied contract, unjust enrichment and violations of state consumer-protection statutes, which is one side's account, not a finding. The record we hold contains no ruling on the merits, because the cases settled.

MGM, represented by Hunton Andrews Kurth LLP, is the defendant in both dockets. Class counsel are nine firms led by John Yanchunis of Morgan & Morgan Complex Litigation Group. The settlement terms in our record come from the proposed long-form notice, not from a court finding.

Who is covered

US residents whose personal information was exposed in the July 2019 breach or the September 2023 cyberattack, and anyone MGM notified, were covered by the settlement. The class definition comes from the proposed long-form notice filed with the court on January 17, 2025.

The class definition for each incident

Two incidents sit in one settlement, each under its own docket.

Both dockets are in Nevada. For the other cases heard in that state, see Gambling Lawsuits in Nevada.

Who was not covered

People outside the United States and people whose information was not exposed or notified are outside the class as defined in the notice. The long-form notice lists further exclusions, which we have not read in detail and do not state here. The administrator named in a notice decides eligibility, not this page.

Is there a payout?

Yes, a payout exists: a USD 45 million fund pays estimated flat amounts of about USD 75, USD 50 or USD 20 by the type of data exposed, or documented losses up to USD 15,000, adjusted pro rata if the net fund is exhausted, and the claim window closed on June 3, 2025. The USD 45 million is a gross fund, not what claimants received.

The payout formula: tiers, documented losses and pro rata adjustment

Fund = USD 45,000,000 gross (both incidents)
Net fund = fund - attorney fees (requested 30 percent, USD 13,500,000; award not verified) - costs - service awards (USD 10,000 or USD 3,500 per representative) - administration costs (to be determined)
Estimated flat payment by data exposed: about USD 75 (SSN or military ID); about USD 50 (passport or driver's license); about USD 20 (name, address, date of birth)
Documented losses: up to USD 15,000 with proof; or one year of credit monitoring
Adjustment: pro rata if the net fund is exhausted
Not confirmed in the record: fee award, administration cost and actual per-claimant amounts

The fee award, service awards and administration costs are not confirmed in the record, so the net fund cannot be stated. Class counsel requested 30 percent of the fund, USD 13.5 million, plus costs, and service awards of USD 10,000 or USD 3,500 per representative. The number of representatives is not in our record.

Documented losses up to USD 15,000 needed proof, and the alternative to a payment was one year of credit monitoring. The amount any one person received depends on the claims filed. Our guide to class action payout per person explains how fund, fees, claim rate and caps combine.

What the net fund can be: bounded estimate

If the requested 30 percent fee were granted in full, the net fund would be about USD 31.5 million before administration costs and service awards.

Derived; assumes the 30 percent fee request is granted in full; administration costs and service awards not estimated.

This is arithmetic, not a court figure. The court sets the fee, and an award can differ from the request. The guide on attorney fees in gambling class actions shows how those awards are measured.

Why some checks differ from the tier amounts

The tiers are estimates; the notice says payments are adjusted pro rata if the net fund is exhausted, so the amount a claimant received can differ from USD 75, USD 50 or USD 20. A claimant with documented losses followed a different path from a flat-tier claimant.

Per-claimant amounts are not published, so we state none. Posts by claimants quote individual check amounts, but they are anecdotes outside the court record and we do not repeat them.

Deadlines and how claims worked (the window is closed)

The claim window closed on June 3, 2025, so no claim is open. Filing was free, and this site never hosted a claim form; we are not a law firm and not the administrator.

The June 3, 2025 claim deadline and the conflicting May 19 date

Secondary sources give June 3, 2025 as the claim deadline; one aggregator's body text gives May 19, 2025 without explanation. We use June 3, 2025, the date in our case record. Deadline conflicts like this are why the claim, exclusion and objection deadlines explained in our guide say to rely on the administrator's notice.

• January 17, 2025: preliminary approval motion filed with the long-form notice (Doc. 62-1). The order followed in January 2025; the exact date is unverified.
• June 3, 2025: claim deadline, the date used on this page.
• May 19, 2025: a date in one aggregator's body text, unexplained.

Checking a legacy MGM settlement notice

A message about this settlement should come from the administrator named in the notice and never ask for a fee.

One secondary source reports the administrator as Epiq, and the settlement site named in the notice is mgmdatasettlement.com, which returned an error to our fetcher. Our guide on how to spot fake settlement and claim sites lists the patterns to check.

Timeline

The settlement covers two incidents four years apart, resolved in one USD 45 million fund.

From the first suit in February 2020 to the claim deadline took about five years. For the usual gaps between approval and payment, read how long gambling lawsuits and settlements take.

What the court has decided so far

Our record holds the long-form notice filed with the preliminary approval motion (Doc. 62-1, January 17, 2025), not the orders themselves. A gaming-news report says Judge Navarro granted preliminary approval in January 2025; the order date is not confirmed in the court record.

One secondary source, an aggregator, reports final approval on June 18, 2025, which it also lists as the hearing date, and payments from December 12, 2025. We have not read the final approval order or the fee award, so both are marked as reported by one secondary source. Nothing in our record decides the merits.

As of June 18, 2025 the status is settled-final: final approval was granted on that date, after the June 3, 2025 claims deadline, according to one secondary source.

Payments were due by the end of 2025, but no payment is confirmed in the court record, so the page does not call the settlement paid. No claim is open.

Documents and sources

Our sources are the long-form notice filed with the court, the administrator's site and three secondary reports, listed here with what each supports.

• Proposed long-form notice, Doc. 62-1, filed January 17, 2025 (secondary copy of a court exhibit): dockets, fund, fee request, service awards, class counsel.
• Administrator site, mgmdatasettlement.com: named in the notice; returned an error to our fetcher, so not read.
• Aggregator settlement page: tiers, claim deadline, reported final approval and payment dates (secondary).
• KTNV report on the settlement: announcement covering both incidents (secondary).
• CDC Gaming brief: claim deadline and January 2025 preliminary approval (secondary).
• Court docket: not retrieved; the final approval order, fee award and payment date are unverified.

Related cases

Four other casino data breach cases show how this settlement is used as the yardstick.

Other casino data breach lawsuits

Other casino data breach cases are still pending, each with its own status.

• Caesars 2023 data breach class action: motion to dismiss denied, as of August 15, 2025.
• Boyd Gaming 2025 data breach lawsuits: filed September 29, 2025.
• Station Casinos 2026 data breach class action: filed May 29, 2026.
• Wynn Resorts 2026 ShinyHunters breach class actions: filed February 21, 2026.

MGM also appears in other suits, collected under MGM Resorts lawsuits.

Other gambling settlements with claims open

Three gambling settlement claims are open in November 2026.

• Pulsz six-state settlement: claim by November 30, 2026.
• High 5 Games Washington verdict and settlement: claim by January 4, 2027.
• The New York Attorney General's VGW redemption runs to August 31, 2027, and every open claim is on open gambling class action settlements by deadline.

Questions people ask

Is the MGM data breach settlement real?

Yes; USD 45 million was agreed and, per one secondary source, final approval was granted on June 18, 2025. See gambling settlements by year and amount for how it compares with other funds.

How much did each person get from the MGM settlement?

Estimated flat payments were about USD 75, USD 50 or USD 20 by data type; actual amounts depend on claims and are not published. The gambling settlement payout per person calculator lets you test your own assumptions.

When were MGM settlement payments sent?

One secondary source reports payments from December 12, 2025, and credit monitoring codes from December 16, 2025. We have not seen a court record of payment dates, so treat both as unconfirmed.

Can I still file a claim in the MGM settlement?

No; the claim window closed on June 3, 2025. The gambling settlement eligibility checker shows which settlements are open now.

Is mgmdatasettlement.com legitimate?

The site named in the notice is mgmdatasettlement.com; check the case number 2:23-cv-01480 and never pay to claim. The is this settlement website legit tool walks through the checks.

Are there other MGM lawsuits or open settlements?

MGM is a party to other cases listed on the company page, MGM Resorts lawsuits. Open claims at other operators are in the related cases section above.