MGM Class Action Lawsuit 2026: Payouts and Updates

Never Miss a Lawsuit Update

Mark Lawfold as a Preferred Source so you never miss a settlement deadline or new filing.

The MGM class action lawsuit is one of the biggest data breach cases moving through federal court in 2026. Millions of MGM Resorts guests had their personal information stolen during a massive cyberattack in September 2023, and the legal fallout is still growing.

If you stayed at an MGM property, used MGM Rewards, or booked through their website, your data may have been exposed. That means you could be entitled to compensation.

For more context, see Lebanon CT Budget Shortfall Lawsuit 2026: What You Need

This article breaks down everything about the lawsuit right now. You’ll find the latest settlement updates, estimated payout ranges, eligibility rules, filing steps, and key deadlines. Roughly 10.6 million people received breach notification letters, making this one of the largest hospitality data breaches in U.S. history.

MGM Class Action Lawsuit 2026

The MGM class action lawsuit in 2026 refers to the consolidated federal litigation against MGM Resorts International over its September 2023 data breach. Multiple lawsuits filed across the country have been grouped together for efficiency.

These cases are being handled in the U.S. District Court for the District of Nevada. The original complaints were filed in late 2023, and the case has progressed through discovery and class certification motions throughout 2024 and 2025.

By 2026, the case has reached a stage where settlement talks are actively underway. Both sides face pressure to resolve the matter before trial.

The lead plaintiffs argue that MGM failed to protect customer data. They claim the company ignored basic cybersecurity protocols despite handling extremely sensitive personal information.

MGM has denied wrongdoing but has not dismissed the possibility of settling. Large corporate defendants in data breach cases typically prefer settlements to avoid unpredictable jury verdicts.

MGM Data Breach Lawsuit

The MGM data breach lawsuit stems from a ransomware attack that crippled MGM Resorts operations for over 10 days in September 2023. Hackers accessed customer databases containing names, addresses, phone numbers, dates of birth, driver’s license numbers, and in some cases, Social Security numbers.

The attack was carried out by a group known as Scattered Spider, which used social engineering tactics to breach MGM’s systems. They reportedly tricked an IT help desk employee into providing access credentials.

Once inside, the hackers deployed ALPHV/BlackCat ransomware. MGM’s entire reservation system, slot machines, digital room keys, and website went offline.

The breach affected guests across all MGM properties:

• Bellagio
• MGM Grand
• Mandalay Bay
• Aria
• Vdara
• The Cosmopolitan
• Park MGM
• New York-New York
• Luxor
• Excalibur

Plaintiffs allege that MGM stored sensitive data without proper encryption. Court filings suggest the company lacked multi-factor authentication on key internal systems, which made the social engineering attack possible.

The financial damage to MGM itself exceeded $100 million in lost revenue and recovery costs. But the real victims are the guests whose personal data ended up exposed.

MGM Resorts Class Action

The MGM Resorts class action brings together individual claims from guests across the entire United States. Instead of thousands of people filing separate lawsuits, one case represents everyone.

Class action status means that a small group of named plaintiffs represents the entire class. If the court certifies the class, every affected MGM guest automatically becomes a member unless they choose to opt out.

The proposed class includes anyone whose personal information was compromised during the September 2023 breach. That covers hotel guests, MGM Rewards members, convention attendees, and anyone who made online reservations.

Quick Facts:

• Type: Consumer data breach class action
• Defendant: MGM Resorts International
• Proposed Class: All individuals whose data was exposed in the 2023 breach
• Legal Claims: Negligence, breach of implied contract, unjust enrichment, violations of state consumer protection statutes

Several prominent class action law firms are representing the plaintiffs. The legal team has argued that MGM profited from collecting vast amounts of personal data while spending too little on protecting it.

Key Takeaway: The MGM class action lawsuit consolidates millions of individual breach claims into one federal case in Nevada, with settlement negotiations actively progressing in 2026.

MGM Cyberattack Lawsuit

The MGM cyberattack lawsuit centers on how the breach happened and whether MGM could have prevented it. This is the technical backbone of the entire case.

Scattered Spider, the hacking group behind the attack, used a technique called vishing (voice phishing). A hacker called MGM’s IT help desk, impersonated an employee, and convinced the technician to reset login credentials.

That single phone call gave the attackers access to MGM’s internal network. Within hours, they had escalated privileges and deployed ransomware across the company’s systems.

Plaintiffs argue this was preventable. Multi-factor authentication, stricter identity verification for help desk calls, and better employee training could have stopped the attack.

MGM’s defense will likely argue the attack was sophisticated and that even well-protected companies fall victim to social engineering. But the plaintiffs have cybersecurity experts ready to testify that MGM’s defenses were below industry standards.

The cyberattack angle strengthens the negligence claims significantly. When a company holds data for millions of people, courts expect a high standard of protection.

MGM Data Breach Settlement

The MGM data breach settlement is the expected outcome of the class action litigation. As of 2026, formal settlement talks are underway, though no final agreement has been publicly announced.

Data breach class actions rarely go to trial. The pattern in similar cases shows that companies prefer to settle rather than risk a jury verdict. Historically, hospitality and casino data breach settlements have ranged from $10 million to $400 million depending on the number of victims and the severity of the data exposed.

Comparable recent settlements provide a useful benchmark:

Given MGM’s breach size and the sensitivity of the data involved, legal analysts expect a settlement in the range of $45 million to $150 million. The final number depends on how many class members had Social Security numbers exposed versus just names and contact information.

Settlement negotiations typically involve a mediator. Both sides have strong incentives to reach a deal before trial costs escalate further.

MGM Lawsuit Payout

The MGM lawsuit payout for individual class members will depend on the total settlement fund and how many people file valid claims. Not everyone who qualifies will actually file, which increases the per-person amount.

Based on similar data breach settlements, here are the expected payout tiers:

If you can prove actual identity theft or financial fraud resulting from the breach, your payout will be significantly higher. Keep receipts, bank statements, and any documentation of unauthorized transactions.

The basic “no proof” tier is where most claimants will fall. Think of it like the Equifax settlement: most people got between $25 and $125 for basic claims. MGM’s payout structure will likely follow a similar model.

One thing to know: lawyers’ fees come off the top. Class action attorneys typically take 25% to 33% of the total settlement fund before distribution. That’s standard in these cases.

Key Takeaway: Individual MGM lawsuit payouts will likely range from $25 for basic claims to several thousand dollars for victims who can document actual identity theft or financial harm.

MGM Settlement Amount

The MGM settlement amount has not been finalized as of early 2026. Settlement negotiations are ongoing, and the total fund could shift based on the strength of evidence presented during discovery.

Legal experts tracking the case estimate the total settlement will fall between $45 million and $150 million. Several factors will determine where the final number lands.

Factors pushing the amount higher:

• Social Security numbers were exposed for a portion of victims
• Over 10.6 million people were affected
• MGM’s cybersecurity practices appear to have fallen below industry standards
• The attack was preventable with basic protections like multi-factor authentication

Factors that could lower the amount:

• Not all victims had sensitive data like SSNs exposed
• MGM provided free credit monitoring and identity protection services after the breach
• Some class members may struggle to show concrete financial harm

The settlement amount will be divided into a claims fund (for victims), attorney fees, administration costs, and incentive awards for named plaintiffs.

Named plaintiffs who led the case typically receive $2,500 to $15,000 each as service awards. The bulk of the fund goes to class members who file claims.

MGM Data Breach Compensation

MGM data breach compensation refers to the money and services class members may receive through the settlement. Compensation typically comes in two forms: cash payments and non-monetary benefits.

Cash compensation tiers are based on the type and severity of harm suffered. Victims with documented losses get more than those filing basic claims.

Non-monetary compensation usually includes:

• Credit monitoring (2 to 4 years of free service)
• Identity theft protection through providers like Kroll
• Identity restoration services if fraud occurs
• Dark web monitoring for exposed data

MGM already offered some credit monitoring after the breach in 2023. The settlement may extend or upgrade those services.

One important detail: if you already enrolled in MGM’s free monitoring program after the breach, that doesn’t prevent you from claiming settlement compensation. These are separate benefits.

To maximize your compensation, document everything. Save copies of your breach notification letter. Screenshot any suspicious activity on your accounts. Keep records of time spent dealing with the breach.

The court will appoint a claims administrator to process all claims. You’ll file through a dedicated settlement website once the deal is approved.

MGM Lawsuit Eligibility

MGM lawsuit eligibility is straightforward. If your personal information was compromised in the September 2023 MGM Resorts data breach, you are likely eligible to participate in the class action.

The broadest eligibility group includes anyone who:

• Stayed at an MGM Resorts property before or during September 2023
• Had an MGM Rewards loyalty account
• Made a reservation through MGM’s website or app
• Attended a convention or event at an MGM property
• Used BetMGM and provided personal information

Eligibility Checklist:

You don’t need to have suffered actual financial losses to be eligible. The exposure of your personal data alone creates standing to participate.

However, you do need to be able to verify that MGM had your personal information. A hotel reservation, loyalty account, or notification letter serves as proof.

Key Takeaway: Almost anyone who interacted with MGM Resorts and shared personal information before or during September 2023 likely qualifies for the class action lawsuit.

See also: Clinique Advertising Dispute Model Lawsuit 2026 Updates

Who Qualifies for MGM Lawsuit

Who qualifies for the MGM lawsuit depends on whether your data was part of the compromised records. The simplest way to know is whether you received a breach notification letter from MGM in late 2023 or early 2024.

MGM sent notification letters to approximately 10.6 million individuals. If you got one, you’re in. Period.

But even if you didn’t receive a letter, you may still qualify. Mail gets lost. People move. Some notifications went to outdated addresses.

Here’s who should check their eligibility:

• Anyone who booked an MGM hotel room between 2017 and September 2023
• MGM Rewards members who created accounts during that period
• People who provided a driver’s license or passport at check-in
• Convention attendees who registered through MGM properties
• BetMGM users who submitted identity verification documents

If your name, email, phone number, date of birth, driver’s license number, or Social Security number was stored in MGM’s systems, you likely qualify.

Some people worry about whether they need a lawyer to join. You don’t. Class members are automatically included unless they actively opt out. Filing a claim when the settlement is approved is free and does not require an attorney.

How to File MGM Class Action Claim

Filing an MGM class action claim is a simple online process once the settlement receives final court approval. Here’s what to expect step by step.

Step 1: Wait for settlement approval. The court must grant preliminary and then final approval. This is expected in mid to late 2026.

Step 2: Visit the official settlement website. A claims administrator will create a dedicated site. The website address will be included in the class notice sent to all eligible members.

Step 3: Fill out the claim form. You’ll enter your name, contact information, and details about your connection to MGM (hotel stays, loyalty account, etc.).

Step 4: Choose your claim tier. Select whether you’re filing a basic claim or an enhanced claim with documentation of losses.

Step 5: Submit supporting documents (if applicable). For higher payouts, upload proof of identity theft, unauthorized charges, or time spent dealing with the breach.

Step 6: Wait for processing. Claims administrators typically take 3 to 9 months to process and distribute payments after the final approval date.

Keep your breach notification letter. It’s the easiest proof of eligibility. If you lost it, your MGM Rewards account or hotel booking confirmation works too.

MGM Data Breach Claim

An MGM data breach claim is the formal request you submit to receive compensation from the settlement fund. Your claim must be filed before the deadline set by the court.

There are typically two types of claims in data breach settlements:

Basic claims require minimal documentation. You confirm your identity and your connection to MGM. These claims get the lowest payout tier but are the easiest to file.

Enhanced claims require proof of actual harm. This could include bank statements showing fraudulent charges, credit reports showing unauthorized accounts, FTC identity theft reports, or police reports.

Important tips for your claim:

• File early. Claims submitted closer to the deadline sometimes face processing delays.
• Be accurate. Incorrect information can delay or void your claim.
• Save confirmation. After submitting, save your confirmation number and any receipt emails.
• Check your claim tier. Make sure you select the right category. Underselling your damages means leaving money on the table.

The claims administrator reviews every submission. If something looks off, they’ll contact you for clarification before denying the claim.

You cannot file a claim through a random website or third-party service. Only the official settlement website (announced by the court) is legitimate. Watch out for scam sites trying to collect your information.

Key Takeaway: Filing an MGM data breach claim is free, can be done online, and does not require a lawyer, but you should gather your documentation now to maximize your potential payout.

MGM Resorts Data Breach Timeline

The MGM Resorts data breach timeline starts in September 2023 and extends into 2026 as the legal case progresses toward resolution.

The timeline shows a case that’s been moving at a typical pace for data breach class actions. These cases usually take 2 to 4 years from breach to final settlement distribution.

The gap between the breach and the payout can feel frustrating. But complex litigation involving millions of class members and billions in corporate data simply takes time to resolve.

MGM Hack Lawsuit Status

The MGM hack lawsuit status as of 2026 is in the late pre-trial and settlement negotiation phase. The case has cleared several procedural hurdles and is approaching resolution.

Here’s where things stand:

• Discovery is complete or near-complete. Both sides have exchanged documents, deposition testimony, and expert reports.
• Class certification has been addressed. The court has ruled on whether the case can proceed as a class action.
• Settlement talks are active. Both parties have engaged in mediation sessions with a court-appointed or agreed-upon mediator.
• No trial date has been set for the core data breach claims, which is a strong indicator that both sides are working toward a deal.

The status could shift if settlement talks break down. In that scenario, the court would schedule a trial, which would push the timeline into 2027 or later.

But breakdown is unlikely. MGM has strong financial incentives to settle. A trial means unpredictable damages, negative publicity, and the risk of a jury sympathetic to millions of breach victims.

For class members, the current status means one thing: be patient but be ready. When the settlement is announced, you’ll need to file your claim within a specific window. Missing the deadline means missing your payout.

MGM Lawsuit Update 2026

The most significant MGM lawsuit update in 2026 is the progression toward a formal settlement agreement. After more than two years of litigation, both sides appear close to resolving the case.

Key 2026 developments:

• Mediation sessions have taken place between plaintiff attorneys and MGM’s legal team
• Expert discovery has revealed the extent of MGM’s cybersecurity shortcomings
• The court has addressed motions to dismiss filed by MGM (most claims survived)
• State attorney general investigations (including Nevada) have put additional pressure on MGM to settle

The broader legal environment is also pushing this case forward. Courts in 2025 and 2026 have been increasingly aggressive about holding companies accountable for data breaches. Several large settlements in unrelated cases have established higher benchmarks.

MGM’s insurance carriers are also likely involved in the settlement discussions. The company’s cyber insurance policies would cover a significant portion of any payout, which makes settling more financially attractive for MGM.

For victims watching from home, the 2026 update boils down to this: a settlement announcement could come at any time. When it does, you’ll receive a formal notice by mail or email explaining your options.

Stay alert for official communications. Don’t rely on social media rumors or unofficial sources for case updates.

Key Takeaway: The MGM lawsuit is moving toward settlement in 2026, and affected individuals should keep their contact information current and watch for official court notices about the claims process.

MGM Resort Fee Class Action

The MGM resort fee class action is a separate legal matter from the data breach case. This lawsuit challenges the hidden “resort fees” that MGM charges on top of advertised room rates.

Resort fees are mandatory daily charges (often $30 to $50 per night) added at checkout. Plaintiffs argue these fees are deceptive because they’re not prominently displayed in the advertised price.

The argument is simple: if a hotel room is listed at $99 per night but you’re charged an additional $45 resort fee at checkout, the real price is $144. Plaintiffs say this is a bait-and-switch that violates consumer protection laws.

Something similar worth reading: Listerine Class Action Lawsuit: 2026 Guide and Updates

The FTC has taken a strong stance against junk fees in the hospitality industry. New federal rules on price transparency may give these lawsuits additional strength in 2026.

This case affects a different group than the data breach lawsuit. If you paid resort fees at any MGM property, you may be eligible for the resort fee class action even if you weren’t part of the data breach.

You may want to read Startups Lawsuit 2026: Eligibility, Payouts and Deadlines

It’s possible to be a class member in both lawsuits simultaneously. The cases are legally separate with different claim processes.

MGM Identity Theft Lawsuit

The MGM identity theft lawsuit represents the most serious claims within the broader data breach litigation. These claims come from victims who experienced actual identity theft after the breach.

Identity theft is the worst-case scenario for breach victims. When hackers steal Social Security numbers, driver’s license numbers, and dates of birth, they have everything needed to open fraudulent accounts, file fake tax returns, or commit other financial crimes.

Some MGM breach victims have reported:

• Unauthorized credit card accounts opened in their names
• Fraudulent tax filings using their Social Security numbers
• Loan applications submitted by identity thieves
• Bank account takeovers using stolen personal details
• Medical identity theft where someone uses their insurance information

Victims of actual identity theft stand to receive the highest compensation in any settlement. While basic claimants may get $25 to $75, identity theft victims with documentation could receive $1,000 to $25,000 or more.

The key is documentation. File an identity theft report with the FTC at IdentityTheft.gov. File a police report. Put fraud alerts on your credit files with all three bureaus: Equifax, Experian, and TransUnion.

These records become your evidence. Without them, proving that your identity theft resulted from the MGM breach rather than some other source becomes much harder.

If you’ve experienced identity theft and believe it’s connected to the MGM breach, you should also consider filing an individual lawsuit for damages beyond what the class action settlement covers. Named plaintiffs’ attorneys can advise you on this option.

MGM Data Breach Notification

The MGM data breach notification is the letter or email that MGM sent to individuals whose data was compromised. Approximately 10.6 million people received these notifications starting in October 2023.

The notification included:

• Confirmation that your data was accessed
• A description of what types of information were exposed
• An offer for free credit monitoring and identity protection (typically through Kroll)
• Instructions for enrolling in the monitoring service
• Contact information for questions

If you received this letter, keep it. It’s your simplest proof of eligibility for the class action settlement.

What if you never received a notification?

Some people moved between the time of the breach and when letters were sent. Others may have had outdated addresses on file with MGM. If you believe your data was compromised but didn’t get a letter, you can still check your eligibility through the settlement website once it goes live.

The notification letter is not the same as the class action notice. The breach notification came from MGM directly. The class action notice will come from the court and the claims administrator. They are two different documents.

When the settlement is approved, a separate notice will be sent to all class members explaining the settlement terms, payout options, and claim filing deadline. Watch for both types of communication.

Quick tip: Search your email inbox for messages from MGM Resorts or Kroll from late 2023 or early 2024. Electronic notifications were sent to many guests who had email addresses on file.

Key Takeaway: Your MGM data breach notification letter is the single most important document for your claim, so locate it now and keep it safe until the settlement claims process opens.

Frequently Asked Questions

How much money will I get from the MGM class action lawsuit?

Most claimants can expect between $25 and $500 depending on the type of data exposed.

Victims who can document actual identity theft or financial losses may receive $1,000 to $25,000.

Final payout amounts depend on the total settlement fund and how many people file claims.

Is the MGM data breach lawsuit still open in 2026?

Yes, the MGM data breach lawsuit is active and moving toward settlement in 2026.

Settlement negotiations are underway in the U.S. District Court for the District of Nevada.

A formal settlement announcement is expected by mid to late 2026.

How do I file a claim for the MGM data breach settlement?

You will file your claim through the official settlement website once the court grants preliminary approval.

The process involves completing an online form and submitting proof of your connection to MGM.

Watch for a formal class notice by mail or email with the website address and filing deadline.

Who qualifies for the MGM Resorts class action lawsuit?

Anyone whose personal data was compromised in the September 2023 MGM breach qualifies.

This includes hotel guests, MGM Rewards members, convention attendees, and BetMGM users.

If you received a breach notification letter from MGM, you are eligible.

When is the deadline to join the MGM class action lawsuit?

The exact deadline has not been set as of early 2026.

It will be established when the court approves the settlement and issues a formal class notice.

Deadlines in data breach class actions typically give claimants 60 to 120 days to file after the notice is issued.

This case is heading toward a resolution that could put real money in the hands of millions of affected guests. The smart move right now is to locate your breach notification letter, gather any evidence of identity theft or financial harm, and keep your contact information current.

When the settlement website goes live, file your claim immediately. Don’t wait until the last day. Early filers face fewer complications.

Stay informed. Your data was compromised, and this settlement exists to make that right.

For a deeper understanding, check Charles Schwab Class Action Lawsuit: 2026 Full Guide

A closely related topic: Biggest Class Action Lawsuit Payout Per Person 2026

Something similar worth reading: Business Lawsuit Israel 2026: Full Filing and Payout Guide

Never Miss a Lawsuit Update

Mark Lawfold as a Preferred Source so you never miss a settlement deadline or new filing.