MGM Resorts International is facing a hefty $45m settlement in a consolidated class-action lawsuit related to two separate major data breaches. A federal court preliminarily approved the agreement for the issues that occurred in 2019 and 2023, with final confirmation set for June. The casino company might also still be subject to an investigation by the Federal Trade Commission.

The first incident occurred in July 2019 when a hacker accessed the personal information of millions of MGM customers, including their home addresses and passport numbers.

The other fault was in September 2023 when the company suffered a ransomware attack that led to mass disruption of its Las Vegas properties and resulted in about $100m in losses.

about 37 million customer records were impacted

The attackers allegedly accessed guest information at the same time, with the complaint claiming that between the two incidents, about 37 million customer records were impacted.

The lawsuit claims that the casino company didn’t have proper data security systems in place, leading to the breaches.

The compensation that plaintiffs will receive in this case depends on the extent of their stolen information. For example, if the hacker accessed an individual’s military identification number or Social Security number, they’re entitled to $75. The most someone can get is $15,000. Of course, the legal team will make out the best, able to claim as much as $13.5m of the $45m total.