The Attacks
In September 2023, the hacking group known as Scattered Spider struck two casino giants in quick succession. Caesars Entertainment was breached in August, and MGM Resorts in September; both were ransomware-style intrusions in which attackers gained deep access to systems, reportedly using social-engineering calls to IT help desks. Caesars reportedly paid about $15 million in ransom, while MGM endured days of visible operational disruption at its properties.
The breaches exposed sensitive loyalty-program data — reportedly including names, addresses, Social Security numbers, passport and driver’s-license numbers — for tens of millions of customers.
The Lawsuits and Settlement
Multiple class actions were filed in Nevada federal court against both companies, alleging they failed to protect loyalty members’ personal information. MGM Resorts agreed to a $45 million settlement resolving claims tied to its 2019 and 2023 breaches, with preliminary approval reported in early 2025. Litigation over the Caesars breach proceeded separately.
The help-desk social-engineering method behind these attacks made them a widely studied example of how human processes, not just software, are a security weak point.
What Affected People Should Know
If you are an MGM or Caesars loyalty member, assume some data may have been exposed. Where Social Security or ID numbers were involved, a credit freeze is the strongest step, along with watching for identity theft. Verify any settlement claim only through the court-approved administrator.
Before You Act
Thinking About Filing a Claim?
Most plaintiff lawyers offer a free initial consultation and work on contingency, meaning no fee unless there is a recovery. LawsuitWatch is not a law firm: we publish explainers, and we do not provide legal advice, representation or referrals. Your state bar directory is the reliable place to find and verify a lawyer.
MGM and Caesars Data Breach Lawsuit: The 2023 Casino Hacks: Frequently Asked Questions
Answers to the most common questions about this case and your legal options.
What happened in the MGM and Caesars breaches?
In 2023 the Scattered Spider group breached both casino companies using help-desk social engineering. Caesars reportedly paid ~$15 million ransom; MGM faced days of disruption. Loyalty data for tens of millions was exposed.
Is there a settlement?
MGM Resorts agreed to a $45 million settlement over its 2019 and 2023 breaches, with preliminary approval reported in early 2025. Caesars litigation proceeded separately.
What data was exposed?
Reportedly names, addresses, Social Security numbers, and passport and driver's-license numbers of loyalty-program members. Consider a credit freeze if yours was involved.
Legal Disclaimer
This article is general legal information, not legal advice, and does not create an attorney-client relationship. Case status, eligibility criteria, and any amounts described are as reported at the date shown and may change. Consult a licensed attorney in your jurisdiction about your own situation.