MGM Resorts International has agreed to pay US$45 million to settle a Federal Trade Commission (FTC) investigation into a major data breach that occurred in 2023, exposing the personal information of approximately 37 million customers. The agreement, announced this week, brings an end to the FTC’s legal action against the global hospitality and entertainment giant.
As part of the settlement, affected individuals have been notified via email and provided with instructions to file claims for financial compensation. Eligible claimants may receive payments based on the sensitivity of the compromised data. Those whose Social Security numbers were exposed may be entitled to US$75; individuals whose passport or driver’s license numbers were compromised can receive US$50; and those whose address and birthdate were leaked may claim US$20. In addition to the financial settlement, the company is offering a year of free credit monitoring services. The deadline for submitting claims is June 3.
The breach was part of a broader cybersecurity incident that also affected Caesars Entertainment. In October 2023, a hacking group known as Scattered Spider infiltrated the IT systems of both companies. Caesars reportedly paid a US$30 million ransom to the attackers to prevent disruptions. MGM Resorts, however, opted not to comply with the ransom demand—a decision that led to widespread operational chaos.
The refusal triggered a cascade of disruptions at MGM’s properties nationwide. Slot machines stopped working, hotel reservations were thrown into disarray, and critical systems—from telephones to digital room keys—went offline. CEO Bill Hornbuckle later described the experience as a near-total blackout across MGM’s 36,000 hotel rooms and regional properties.
“We found ourselves in an environment where for the next four or five days… we were completely in the dark,” Hornbuckle said. “Literally, the telephones, the casino system, the hotel system – and I could go on and on – were not functioning. And so… you put the company to the test.”
The breach, recovery, and resulting disruptions ultimately cost the company an estimated $100 million, according to a filing with the US Securities and Exchange Commission.
Prior to the settlement, MGM had taken legal action against the FTC in response to the commission’s broad data request. The FTC sought information about the company’s cybersecurity protocols, previous breaches, identity theft mitigation efforts, and personnel responsible for data security. The settlement ends that litigation and closes the regulatory inquiry.
