MGM Resorts faces lawsuit over breach exposing 10.6 million guests’ data

MANILA, Philippines – US casino and hotel giant MGM Resorts International is being sued for a data breach that exposed the personal and contact information of over 10.6 million of its guests.

According to Reuters, the lawsuit was filed Friday, February 21, at the US District Court for the District of Nevada by Florida-based law firm Morgan & Morgan as “complaint for damages” and “injunctive relief.”

The complaint will be led by attorney John Yanchunis, who has been associated with several other data breach lawsuits in the past, including ones against Equifax, Yahoo, and Cambridge Analytica.

MGM confirmed to tech website ZDNet it discovered their cloud server containing a “limited amount of information for certain previous guests” was hacked last year.

The information taken from that security incident, which contained personal details such as full names, home addresses, phone numbers, emails, and dates of birth, was reportedly published last week in a popular hacking forum.

Some of the affected guests include celebrities like singer Justin Bieber, tech CEOs like Twitter chief Jack Dorsey, and government officials like US Department of Homeland Security and Transportation Security Administration personnel, to name a few.

Citing Irina Nesterovsky, the Head of Research at threat intel firm KELA, ZDNet claims the leaked data had been shared in some underground hacking forums since at least July of last year.

The culprit is believed to be associated, or a member of GnosticPlayers, a hacking group notorious for stealing and releasing hundreds of millions of user data online.

However, MGM told ZDNet that the most data was old, and that no financial information was taken.

The company also said it notified all guests who were affected by the breach last year.

“At MGM Resorts, we take our responsibility to protect guest data very seriously, and we have strengthened and enhanced the security of our network to prevent this from happening again,” said MGM Resorts.

This is not the first time a major data breach was reported in a resorts and casino chain. In 2018, Marriott International disclosed that they were the victims of a similar security incident during which the private details of up to 500 million of its guests were stolen. It later said that while the security incident was smaller in scale, the attackers did take some 5.25 million passport numbers. – Rappler.com