MGM class action claims data breach exposed sensitive customer information

MGM data breach class action lawsuit overview: 

• Who: Tonya Owens filed a class action lawsuit against MGM Resorts International. 
• Why: Owens claims MGM Resorts was negligent while allegedly failing to prevent a cyberattack earlier this month that led to a data breach.
• Where: The class action lawsuit was filed in Nevada federal court. 

MGM Resorts International failed to prevent a cyberattack earlier this month that led to a data breach that exposed the personally identifiable information (PII) of its customers, a new class action lawsuit alleges. 

Plaintiff Tonya Owens claims cyberattackers were able to acquire access credentials to MGM Resorts’ network on Sept. 7 by allegedly impersonating an IT admin. 

Owens argues the incident, in addition to locking MGM Resorts guests out of using resort services, led to a data breach that exposed its customers’ PII, including their names, birthdates, addresses and Social Security numbers, among other things. 

“Defendant failed to adequately protect Plaintiff’s and Class members PII — and failed to even encrypt or redact this highly sensitive information,” the MGM Resorts class action states. 

Owens wants to represent a nationwide class of consumers who had their PII exposed in the MGM Resorts data breach that began Sept. 7. 

Two competing hacking groups take responsibility for cyberattack against MGM, class action says

Two competing hacking groups have taken responsibility for the cyberattack, including a group known as “The Scatter Spider,” and another called ALPHV, according to the MGM class action. 

Owens argues MGM was ultimately negligent or acted carelessly in protecting the PII of its customers, despite allegedly having assumed “legal and equitable duties to those individuals to protect and safeguard that information from unauthorized access and intrusion.” 

“This unencrypted, unredacted PII was compromised due to Defendant’s negligent and/or careless acts and omissions and its utter failure to protect consumers’ sensitive data,” the MGM REsorts class action states. 

Owens claims MGM Resorts is guilty of unjust enrichment, breach of implied contract, and negligence and negligence per se. 

The plaintiff is demanding a jury trial and requesting declaratory and injunctive relief along with an award of actual, compensatory, statutory, nominal, and punitive damages for herself and all class members. 

In another complaint involving MGM Resorts, a class action lawsuit was filed against the company last September by a consumer claiming it refuses to refund cash change to gamblers who try to cash-out at its casinos. 

Were you affected by the MGM Resorts data breach? Let us know in the comments. 

The plaintiff is represented by Nathan R. Ring and J. Gerard Stranch IV of Stranch, Jennings & Garvey PLLC and Gary Klinger of Milberg Coleman Bryson Phillips Grossman LLC. 

The MGM data breach class action lawsuit is Owens v. MGM Resorts International, Case No. 2:23-cv-01480, in the U.S. District Court for the District of Nevada.

Read About More Class Action Lawsuits & Class Action Settlements:

• Honeywell class action claims data breach exposed personal information of 100,000+
• Temu class action alleges company failed to protect customer data, resulting in breach
• T-Mobile customers report seeing other people’s account information in app
• Caesars reports cyberattack but did not go offline