MGM Resorts (2022 Update) mgmresorts.com MGM Resorts 2022 leak update: what happened and what to do
MGM Resorts found a breach of a cloud service in July 2019. A larger copy of the data surfaced in 2022, covering about 24.8 million email addresses. It included names, email and physical addresses, phone numbers and dates of birth.
View all 13,115 breaches- Breach date
- 25 Jul 2019
- Affected
- 24,842,001
- Data exposed
- Dates of birth, Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In July 2019, MGM Resorts discovered a data breach of one of its cloud services. The first reports, in February 2020, described 10.6 million guest records. MGM said it notified affected guests as required by state law, hired two cybersecurity forensics firms and worked with law enforcement. It said no financial, payment card or password data was involved.
In May 2022, a much larger set of the data, about 24.8 million unique email addresses, was added to Have I Been Pwned. The 2022 data very likely comes from the same incident: the exposed records date back to 2017, and a version of them had been offered for sale in mid-2020.
What was exposed
The data included names, email addresses, physical addresses, phone numbers and dates of birth. That is enough for convincing phishing, text scams that quote a real stay or address, and identity fraud attempts that lean on a date of birth.
What it means for you
If you stayed at an MGM property before 2020, your details may be in the data. No passwords or card numbers were involved, so the main risk is scams that use your real details, not account takeover.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Emails, texts and calls that use your real details look convincing. Don't click links in unexpected messages; go to the company's site yourself.
- 2
Be careful with calls about your accounts
A date of birth plus your address is what scammers use to pass as your bank or phone carrier. Hang up and call the number on your card or bill.
- 3
Watch for new accounts in your name
If you're in the US, consider a free credit freeze at Equifax, Experian and TransUnion, since dates of birth were exposed.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak.
Frequently asked
Was I affected by the MGM Resorts breach?
If you were an MGM guest before 2020, possibly. Have I Been Pwned lists about 24.8 million email addresses from this data, and you can search yours there or with a free Serus scan.
What was exposed?
Names, email addresses, physical addresses, phone numbers and dates of birth. MGM said no financial, payment card or password data was involved.
Should I change my password?
Passwords weren't part of it, so it isn't urgent for this breach. It's still smart to use unique passwords and two-factor login everywhere.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
