The MGM lawsuit is one of the largest data breach class actions in U.S. history, and in 2026, affected consumers can still file claims for compensation. If you stayed at an MGM hotel, played at an MGM casino, or joined the M life Rewards program before September 2023, your personal data may have been stolen.
This article breaks down exactly what happened, who qualifies, how much you could receive, and what steps to take right now.
Over 10 million people may be eligible for compensation. The numbers are staggering, and most affected consumers still don’t know they have a right to file.
Read every section below. This is the complete picture for 2026.
What Is the MGM Lawsuit?
The MGM lawsuit is a class action legal case against MGM Resorts International, stemming from a catastrophic cyberattack in September 2023 that exposed the sensitive personal data of millions of customers.
Plaintiffs claim MGM failed to protect their information despite clear industry warnings about ransomware threats targeting casino operators. That failure, they argue, was negligence.
The lawsuit covers multiple types of claims. These include data breach liability, identity theft damages, and financial losses tied directly to the exposure of personal information.
MGM operates some of the most recognized hotel and casino brands in the world. Properties involved include the MGM Grand, Bellagio, Mandalay Bay, The Cosmopolitan, Aria, and Vdara, all under the MGM Resorts umbrella.
| Case Type | Legal Basis |
|---|---|
| Data Breach Class Action | Negligence, breach of contract |
| Personal Injury Claims | Emotional distress, financial harm |
| Investor Lawsuit | Securities fraud |
| RICO Allegations | Racketeering and organized criminal conduct |
The case is being heard in U.S. District Court for the District of Nevada.
MGM Resorts Lawsuit 2026: Where Things Stand Right Now
As of 2026, the MGM Resorts lawsuit is in active settlement negotiation and litigation phases, with courts managing both the consolidated class action and separate personal injury tracks.
The original cyberattack happened in September 2023. Cases moved quickly through initial filings in late 2023 and throughout 2024. By 2025, the courts consolidated dozens of individual lawsuits into a coordinated proceeding.
In 2026, the focus has shifted to finalizing settlement terms, distributing claim forms, and setting final deadlines for class members to participate.
Think of it like a large insurance claim process, except the “insurer” here is a court-supervised settlement fund that MGM has been pressured to contribute to through legal proceedings.
| Timeline Phase | Status in 2026 |
|---|---|
| Cyberattack Occurs | September 2023 (complete) |
| Lawsuits Filed | Late 2023 through 2024 (complete) |
| Cases Consolidated | 2024 to 2025 (complete) |
| Settlement Negotiations | Active in 2026 |
| Claim Filing Window | Open in 2026 |
| Expected Payments | Late 2026 to early 2027 |
MGM has not publicly admitted wrongdoing, which is standard in class action settlements.
The MGM Data Breach Lawsuit Explained
The MGM data breach lawsuit is the primary legal action targeting MGM Resorts for its failure to prevent a cyberattack that exposed the personal records of an estimated 10 to 30 million people.
The data stolen included names, addresses, phone numbers, email addresses, dates of birth, driver’s license numbers, Social Security numbers, and passport numbers. For many victims, this is the kind of information that enables identity theft for years.
Plaintiffs argue MGM knew about vulnerabilities in its systems and failed to act fast enough. They also claim the company delayed notifying customers after the breach was discovered.
That delay is legally significant. Under federal and Nevada state law, companies must notify affected consumers promptly. Every day of delay compounds the harm.
Key data exposed in the MGM breach:
- Full legal names
- Physical and mailing addresses
- Email addresses and phone numbers
- Dates of birth
- Social Security numbers
- Driver’s license numbers
- Passport numbers
- Limited payment card data (for some customers)
- M life Rewards account details
Key Takeaway: The MGM data breach lawsuit targets MGM Resorts for negligently exposing millions of customers’ most sensitive personal information, with Social Security and passport numbers among the stolen data.
How the MGM Cyberattack Happened
The MGM cyberattack was carried out using a shockingly simple technique known as social engineering, not some complex technical exploit.
Hackers reportedly called MGM’s IT help desk, impersonated an employee, and convinced support staff to reset account credentials. That single phone call gave attackers access to MGM’s internal systems.
From there, they deployed ransomware that shut down MGM’s hotel check-in systems, casino slot machines, digital room keys, ATMs, and reservation platforms. The disruption lasted more than 10 days.
It’s almost like someone sweet-talked their way past the front door by pretending to be the delivery guy. Except the delivery guy walked off with the entire building.
MGM’s response was to refuse to pay the ransom. That decision kept millions of dollars in MGM’s pocket but left the attackers with stolen data they reportedly sold or released.
| Attack Method | Detail |
|---|---|
| Entry Point | Social engineering via IT help desk call |
| Group Responsible | Scattered Spider, working with ALPHV/BlackCat |
| Systems Disrupted | Hotel check-in, slot machines, ATMs, reservations |
| Duration of Disruption | More than 10 days |
| Ransom Demand | Reportedly tens of millions of dollars |
| MGM Response | Refused to pay |
The refusal to pay meant the stolen data was not returned or destroyed.
The ALPHV Ransomware Group Behind the MGM Attack
ALPHV, also known as BlackCat, is the ransomware gang that provided the technical tools used in the MGM cyberattack, working alongside a hacker collective called Scattered Spider.
ALPHV operates as a “ransomware-as-a-service” business. They build and maintain the malware, then partner with affiliate hackers who carry out attacks and split the ransom proceeds.
Scattered Spider is a loosely organized group of primarily English-speaking hackers, some reportedly based in the United States and United Kingdom. They have targeted dozens of major corporations using social engineering tactics.
The connection between these two groups is directly relevant to the MGM lawsuit because plaintiffs argue MGM should have known its industry was being actively targeted. Caesars Entertainment suffered a similar attack just weeks before MGM’s breach.
Why this matters for your claim:
- The attack was not random. MGM’s industry was specifically targeted.
- Prior warnings existed about Scattered Spider’s tactics.
- Caesars Entertainment paid a ransom to avoid data exposure. MGM did not.
- MGM’s refusal to pay contributed directly to the data exposure that harmed consumers.
Key Takeaway: The ALPHV and Scattered Spider groups targeted MGM in a deliberate, coordinated attack, and plaintiffs argue MGM had advance warning that its industry was under threat and failed to prepare.
MGM Class Action Lawsuit: Who Filed and What They’re Claiming
The MGM class action lawsuit was filed by multiple groups of plaintiffs in courts across the country, later consolidated into a coordinated proceeding in Nevada federal court.
Lead plaintiffs include former hotel guests, casino visitors, and M life Rewards loyalty program members. Their claims fall into several legal categories.
Plaintiffs are suing for negligence, breach of implied contract, violation of Nevada consumer protection statutes, violations of the California Consumer Privacy Act (CCPA), and unjust enrichment.
The core argument is consistent: MGM collected personal data, promised to protect it, failed to implement basic cybersecurity safeguards, and then delayed telling people their information was stolen.
Primary legal claims in the MGM class action:
- Negligence in maintaining data security
- Breach of contract and implied contract
- Violation of state consumer protection laws
- Violations of the California Consumer Privacy Act
- Unjust enrichment from profiting off consumer data without adequate protection
- Failure to provide timely breach notification
The class action mechanism allows millions of affected individuals to pursue claims together, which makes the litigation economically feasible when individual damages might be small.
MGM Lawsuit Eligibility: Do You Qualify?
You may qualify for the MGM lawsuit if you provided personal information to MGM Resorts and that information was exposed in the September 2023 cyberattack.
Eligibility is not limited to people who experienced confirmed identity theft. If your data was exposed, you may still qualify even if you have not yet suffered a direct financial loss.
Courts have recognized that the exposure itself creates harm, including the ongoing risk of future identity theft, the time spent monitoring your credit, and the emotional distress of knowing your Social Security number is in criminal hands.
| Eligibility Factor | Detail |
|---|---|
| Time Frame | Must have provided data to MGM before September 2023 |
| Geographic Scope | Primarily U.S. residents; some international guests may qualify |
| Confirmed Identity Theft Required? | No. Exposure alone may be sufficient. |
| Loyalty Program Members | Eligible |
| One-Time Hotel Guests | Eligible if data was collected |
| Casino Visitors | Eligible if data was provided during check-in or gaming |
Receiving a data breach notification letter from MGM is a strong indicator that you qualify.
Who Qualifies for the MGM Lawsuit in 2026?
In 2026, the qualifying class for the MGM lawsuit includes anyone whose personal information was in MGM’s systems at the time of the September 2023 cyberattack.
This is a broad group. MGM operates over 30 properties globally, and the breach affected both domestic and international systems. Loyalty members are almost certainly in the class, as their profiles contained the most detailed personal information.
If you never stayed at MGM but booked a reservation that was later canceled, your data may still have been collected and stored. That’s enough to potentially qualify.
Groups likely covered by the MGM lawsuit:
- M life Rewards loyalty program members
- Guests who checked into any MGM property before September 2023
- Casino visitors who provided ID or created player accounts
- People who made reservations even if they did not complete their stay
- Customers who used MGM’s digital apps or online booking systems
- Employees are typically covered under a separate employment-related proceeding
Key Takeaway: Qualification for the MGM lawsuit in 2026 is broad; you don’t need confirmed fraud on your accounts, just a connection to MGM’s data systems before the September 2023 breach.
How to File an MGM Data Breach Claim
Filing an MGM data breach claim in 2026 involves submitting a claim form through the official settlement administrator’s portal before the court-set deadline.
The process is straightforward. You do not need to hire an attorney to file a basic claim. However, for larger documented losses, legal representation can help maximize your payout.
Here is what the basic filing process looks like:
Step-by-step claim filing:
- Confirm your eligibility using the criteria above
- Locate your data breach notification letter from MGM if you received one
- Visit the official claims administrator website for the MGM settlement (search for the official court-approved site)
- Fill out the online claim form with your personal information
- Upload any supporting documents for enhanced compensation tiers
- Submit before the filing deadline
- Save your confirmation number
Documents that strengthen your claim include any MGM notification letter, records of identity theft or fraud, credit monitoring subscription receipts, and documentation of time spent dealing with the breach.
MGM Settlement 2026: What Has Been Agreed To?
As of 2026, MGM and plaintiffs’ attorneys are working toward a settlement agreement that would establish a fund to compensate class members, though final court approval is still pending.
Settlement negotiations in large data breach cases often take two to three years from the initial breach date. Given that the MGM attack occurred in September 2023, a 2026 settlement timeline is exactly what legal analysts predicted.
Caesars Entertainment, which suffered a near-identical attack at the same time, reportedly paid its ransom and moved faster to resolve customer claims. MGM’s refusal to pay extended both its operational disruption and its legal exposure.
| Settlement Component | Expected Detail |
|---|---|
| Total Fund Size | Under negotiation; estimates range widely |
| Basic Claim (no documentation) | Flat cash payment per claimant |
| Enhanced Claim (documented losses) | Higher payout based on verified harm |
| Credit Monitoring | Multi-year coverage included |
| Identity Theft Protection | Included for qualifying members |
| Court Approval Required | Yes, before payments can be distributed |
No settlement becomes final until a federal judge grants final approval, typically after a fairness hearing.
MGM Lawsuit Payout: How Much Are People Getting?
The MGM lawsuit payout will vary based on the type and severity of harm each claimant can document, but general estimates place basic claims in the range of $50 to $200 for those without documented losses.
For claimants who can show direct financial harm, such as fraudulent charges, identity theft costs, or professional fees paid to resolve fraud, payouts could reach $500 to $5,000 or higher depending on the settlement structure.
This is consistent with how comparable data breach settlements have been structured. Think of it like a tiered system: the more you can prove, the more you can claim.
| Claim Tier | Estimated Payout Range |
|---|---|
| Basic (no documentation needed) | $50 to $200 |
| Mid-Tier (credit monitoring costs, time lost) | $200 to $750 |
| Enhanced (documented fraud, identity theft) | $750 to $5,000+ |
| Extraordinary Harm (severe, documented losses) | Negotiated individually |
These figures are estimates based on comparable settlements. Final amounts depend on court approval, total fund size, and number of valid claims filed.
Key Takeaway: MGM lawsuit payouts in 2026 range from roughly $50 for basic claims to several thousand dollars for claimants who can document real financial harm from the breach.
MGM Data Breach Compensation: What Costs Are Covered?
MGM data breach compensation is designed to reimburse class members for both tangible financial losses and the less visible costs of dealing with a data breach.
Tangible costs that are typically covered in breach settlements include unauthorized charges on accounts, money spent on credit monitoring or identity protection services, fees paid to professionals like accountants or lawyers to address fraud, and costs of replacing identity documents like passports or driver’s licenses.
Less tangible costs, which are harder to document but still compensable, include the time spent monitoring accounts, making fraud-related phone calls, and dealing with the stress of having your personal information stolen.
Types of costs typically covered:
- Unauthorized charges and fraudulent transactions
- Credit monitoring subscription fees
- Identity theft protection service costs
- Cost of replacing ID documents
- Professional fees (legal, accounting) related to fraud resolution
- Lost time calculated at an hourly rate (varies by settlement)
- Out-of-pocket costs directly tied to the breach
Future credit monitoring services, often two to four years of coverage, are almost always included in data breach settlements as non-cash compensation.
How Much Will I Get from the MGM Lawsuit?
Most people filing a basic claim in the MGM lawsuit can expect a payment somewhere between $75 and $150, based on the pattern from similar large-scale data breach settlements.
The total settlement fund size and the number of people who actually file claims are the two biggest variables. If fewer people file, each valid claim gets a larger share. If tens of millions file, the per-person payment drops.
This is why filing promptly matters. A smaller claim pool benefits every valid claimant.
For people who suffered real harm, the calculus is different. If you had to freeze your credit, deal with fraudulent loans opened in your name, or pay to restore your identity, those documented costs can be submitted for a significantly larger payment.
| Factor | Impact on Your Payout |
|---|---|
| Number of claims filed | More claims = smaller individual payouts |
| Documentation provided | More docs = higher payment tier |
| Type of data exposed | SSN/passport exposure = higher base claim |
| Documented identity theft | Largest potential payout category |
| Court-approved fund size | Sets the ceiling for all payments |
The only way to know your specific payout is to file and wait for the settlement administrator’s assessment.
How to File a Claim in the MGM Lawsuit Step by Step
Filing a claim in the MGM lawsuit in 2026 is a process most people can complete in under 30 minutes if they have their basic information ready.
You do not need to be a legal expert. The claims process is specifically designed for everyday people. No court appearances. No depositions. Just a form and any supporting documents you can provide.
Complete step-by-step filing guide:
| Step | Action Required |
|---|---|
| Step 1 | Confirm you qualify (stayed at MGM, used loyalty program, provided data before Sept. 2023) |
| Step 2 | Gather your MGM notification letter if you received one |
| Step 3 | Collect any documentation of losses (receipts, bank statements, fraud reports) |
| Step 4 | Access the official settlement claims portal |
| Step 5 | Enter your personal and contact information |
| Step 6 | Select the claim tier that matches your situation |
| Step 7 | Upload supporting documents for higher-tier claims |
| Step 8 | Submit your claim and save confirmation |
| Step 9 | Monitor your email for updates from the claims administrator |
If you received a notification letter with a unique claim ID, use it. It speeds up verification.
Key Takeaway: Filing an MGM lawsuit claim in 2026 takes less than 30 minutes for most people and requires only basic personal information for the lowest compensation tier.
MGM Lawsuit Filing Deadline 2026: Don’t Miss This Date
The MGM lawsuit filing deadline in 2026 is set by the court and missing it means you permanently lose your right to compensation from the class action settlement.
Courts handling large class actions typically give class members 60 to 120 days from the date of final settlement approval to submit their claims. Once that window closes, it closes for good.
As of publication, the exact final deadline is subject to court confirmation, but plaintiffs’ attorneys and legal analysts expect a mid-to-late 2026 cutoff based on the current litigation timeline.
What to do right now:
- Do not wait for a notification letter to arrive before acting
- Search for the official MGM settlement claims site
- Check your email inbox and spam folder for communications from MGM or the claims administrator
- File your claim as early as possible, not at the last minute
- If you moved since the breach, update your contact information
Deadline context:
| Action | Timing |
|---|---|
| Cyberattack occurred | September 2023 |
| Lawsuits consolidated | 2024 to 2025 |
| Settlement negotiations | Ongoing in 2026 |
| Expected final approval hearing | 2026 |
| Expected claim filing deadline | 60 to 120 days post-approval |
| Expected payment distribution | Late 2026 to early 2027 |
Courts can extend deadlines in rare cases, but counting on that is a risky strategy.
MGM Lawsuit Status Update: Latest Developments
The MGM lawsuit in 2026 is at a pivotal stage, with settlement talks advancing and courts preparing for final approval proceedings.
Key developments from late 2025 into 2026 include the consolidation of related cases under a single coordinated docket, the appointment of lead counsel for the class, and the submission of proposed settlement terms to the presiding judge.
MGM has faced ongoing pressure from regulators as well. The SEC investigated whether MGM disclosed the breach to investors in a timely and accurate manner. The FTC has also scrutinized MGM’s data security practices.
Recent developments at a glance:
- Class certification was granted, allowing the case to proceed as a class action
- Lead plaintiffs and lead counsel have been formally appointed
- Settlement negotiations are in advanced stages as of 2026
- SEC inquiry into MGM’s breach disclosure timing remains active
- MGM reported more than $100 million in direct losses from the cyberattack
- Criminal investigations into Scattered Spider and ALPHV members are ongoing in the U.S. and UK
The criminal cases against the hackers do not directly affect your civil settlement claim, but they provide important context and public documentation of the attack.
MGM Personal Injury Lawsuit: Separate Claims Beyond the Data Breach
The MGM personal injury lawsuit track covers physical and psychological harm experienced by guests and employees during and after the September 2023 cyberattack, separate from the data breach claims.
When MGM’s systems went down, the real-world consequences were immediate. Hotel guests were locked out of their rooms. Casino operations were disrupted. ATMs stopped working. Some guests report being unable to access medication stored in hotel safes, being stranded without functioning key cards, and experiencing significant distress during the chaotic outage.
These experiences form the basis of personal injury claims, which operate on a different legal track than the class action data breach case.
Types of personal injury claims tied to MGM:
- Physical harm due to inability to access medication or medical equipment
- Psychological distress from being locked out, stranded, or unable to communicate
- Financial losses from disrupted travel, canceled events, or inaccessible funds
- Claims by employees who experienced threats or unsafe working conditions during the attack response
Personal injury claims typically require more individualized documentation and may benefit from legal representation. These are not standard claim form submissions; they are more complex legal actions.
MGM Investor Lawsuit: What Shareholders Are Suing For
The MGM investor lawsuit is a securities fraud action filed by shareholders who claim MGM executives misled them about the company’s cybersecurity posture and the true severity of the breach.
Shareholders allege that MGM’s public statements about its data security practices were materially false and misleading, and that when the truth was revealed through the cyberattack, MGM’s stock price dropped significantly, costing investors substantial money.
The SEC’s inquiry into MGM’s breach notification timing runs parallel to the private investor lawsuit. Both focus on whether MGM was honest with the public and its investors.
| Investor Lawsuit Element | Detail |
|---|---|
| Legal Basis | Securities fraud, misrepresentation |
| Plaintiffs | MGM shareholders |
| Core Claim | Executives misled investors about cybersecurity |
| Stock Impact | MGM share price dropped after breach became public |
| Relevant Regulator | SEC (Securities and Exchange Commission) |
| Court | U.S. District Court |
Investor lawsuits and consumer class actions are separate legal proceedings. Winning or losing one does not automatically affect the other.
Key Takeaway: The MGM investor lawsuit runs separately from the consumer class action; shareholders are pursuing securities fraud claims based on alleged misrepresentations about MGM’s cybersecurity strength before the breach occurred.
Frequently Asked Questions
What is the MGM lawsuit about?
The MGM lawsuit is a class action against MGM Resorts International for failing to protect customer data during a September 2023 cyberattack.
Hackers stole the personal information of millions of guests, including Social Security numbers, passport numbers, and driver’s license numbers.
Plaintiffs claim MGM was negligent in its cybersecurity practices and failed to notify consumers promptly.
How much money will I get from the MGM settlement?
Most basic claimants can expect between $50 and $200, while those with documented financial harm may receive $500 to $5,000 or more.
The final payout depends on the total settlement fund, the number of claims filed, and your documentation.
Payments are expected to begin in late 2026 or early 2027 after final court approval.
Who qualifies for the MGM data breach lawsuit?
Anyone who provided personal information to MGM Resorts before September 2023 and whose data was exposed in the breach may qualify.
This includes hotel guests, casino visitors, M life Rewards loyalty members, and people who made reservations even without completing a stay.
You do not need to have experienced confirmed identity theft to be eligible.
What is the deadline to file an MGM lawsuit claim in 2026?
The exact deadline is set by the court after final settlement approval, but claimants typically have 60 to 120 days to file once the settlement is approved.
Courts expect a mid-to-late 2026 deadline based on the current litigation schedule.
Filing early is strongly advised; do not wait for reminder notices.
What data was stolen in the MGM cyberattack?
Stolen data included names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, driver’s license numbers, and passport numbers.
Limited payment card data was also exposed for some customers, along with M life Rewards account details.
The breadth of data stolen is what makes this one of the most serious breaches in U.S. hospitality history.
The Bottom Line on the MGM Lawsuit in 2026
The MGM lawsuit is one of the most significant data breach cases active in U.S. courts right now, and 2026 is the year when class members need to act.
If your data was in MGM’s systems before September 2023, you likely qualify for compensation. File your claim early, document any losses you experienced, and watch for the official filing deadline.
The window won’t stay open forever. Check the official settlement administrator’s site, gather your paperwork, and protect your right to be compensated.
