MGM Resorts International Accused of Negligence in Massive Data Breach

MGM Resorts International is facing a class action lawsuit accusing it of negligently failing to safeguard customer data, which was compromised in a massive data breach last year.

MGM Resorts operates famous luxury resorts, casinos and hotels in the United States. Most MGM locations are hotels and casinos in Las Vegas, Nevada.

Plaintiff E.Z. filed the MGM class action lawsuit on behalf of all persons in Canada whose personal and/or financial information was compromised in the MGM data breach that reportedly occurred in July 2019.

The MGM data breach affects customers who have stayed at the following MGM locations:

• MGM Grand in Las Vegas
• Aria in Las Vegas
• Bellagio in Las Vegas
• Circus Circus in Las Vegas
• Excalibur in Las Vegas
• Luxor in Las Vegas
• Mandalay Bay in Las Vegas
• The Mirage in Las Vegas
• New York-New York in Las Vegas
• Park MGM in Las Vegas
• Signature at MGM Grand in Las Vegas
• MGM Grand Detroit in Detroit, Michigan
• Beau Rivage in Biloxi, Mississippi
• Gold Strike Tunica in Tunica, Mississippi
• Borgata in Atlantic City, New Jersey
• MGM National Harbor in Prince George’s County, Maryland
• MGM Springfield in Springfield, Massachusetts

Other locations may have also been affected by the MGM data breach.

According to the data breach class action lawsuit, MGM found out on July 10, 2019 that an unauthorized third party had accessed and downloaded client information from an external cloud server.

The customer data that was reportedly accessed in the MGM data breach include names, addresses, phone numbers, email addresses, birthdates, credit card information, and other customer information.

Instead of immediately informing affected customers about the MGM data breach, MGM reportedly emailed a small number of affected customers in August 2019 in an effort to downplay the extent of the MGM data breach.

According to the lawsuit, MGM only acknowledged the massive data breach in February 2020 after the technology website Zdnet.com published an article reporting that the personal information for more than 10 million former MGM hotel guests was compromised in the 2019 MGM data breach.

E.Z. says he remained unaware of the MGM data breach until he received an email from MGM on June 12, 2020–nearly a year after MGM first became aware that customer data had been accessed by an unauthorized third party.

The email reportedly offered E.Z. one full year of credit monitoring at no cost, and notified him that he could request that the credit reporting agency Equifax could place a fraud alert on his credit file to protect his data.

When E.Z. called the number listed in the MGM email, he was reportedly directed to Equifax Canada and had to wait a long time for a representative to answer his call. When he did reach a representative, the agent would not confirm any information about the information that was compromised in the data breach and told him to send an email to MGM to ask specific information about the stolen information.

“This is clearly designed to force Class Members to jump through as many hoops as possible and to waste their time, the whole in order to have them give up and no longer continue with their inquiries and concerns against MGM,” the plaintiff alleges in the MGM data breach class action lawsuit.

“Personal information is a valuable commodity,” the MGM data breach class action lawsuit says. “There is a ‘cyber black-market’ available for criminals to openly post personal information on a number of Internet websites in what is known as the ‘dark web’. This demand increases the likelihood of Class Members falling victim to identity theft.”

Because it is difficult to trace user activity on the dark web, it is a “hotbed” of criminal activity where users can buy and sell credit card numbers, drugs, guns, and other private information, the MGM data breach class action lawsuit alleges.

“When a data breach affecting 10.6 million Consumers occurs, Defendant had the obligation to immediately and accurately notify its Customers in order to help them prevent further fraud, identity theft, financial losses, losses of time, stress and inconvenience,” the MGM data breach class action lawsuit says.

E.Z. notes that MGM sent emails to affected customers, but has not posted any information about the MGM data breach on its website. The data breach class action lawsuit says MGM failed to immediately activate the credit monitoring services for affected customers and post proper fraud alerts for affected consumers, and instead waited nearly a year to offer these services to help protect their identities and financial information.

As a result, affected consumers are at increased risk of fraud and/or identity theft, the MGM data breach class action lawsuit asserts.

Have you visited any of the impacted MGM locations? Are you worried about the data breach? Tell us your thoughts in the comment section below! 

The proposed Class is represented by David Assor of Lex Group Inc.

The MGM Resorts Data Breach Class Action Lawsuit is E.Z. v. MGM Resorts International, Case No. 500-06-001078-209, in the Superior Court of Québec, District of Montreal, Canada.

Read More Lawsuit & Settlement News:

Teacher Sexual Abuse Class Action Lawsuit Allowed to Proceed

Suunto Dive Computer Class Action Lawsuit Alleges Life-Threatening Defects

Long Term Disability Lawyer | Insurance Claim Denial Help

Canada Roundup Glyphosate Cancer Class Action Lawsuit Investigation