MGM Resorts mgmresorts.com MGM Resorts data breach: what happened and what to do
In July 2019, MGM Resorts found unauthorized access to a cloud service. Data on 10.6 million guests, with 3,081,321 unique email addresses, later appeared on a hacking forum. It included names, emails, phone numbers, addresses and dates of birth. MGM said no payment card or password data was involved.
View all 13,115 breaches- Breach date
- 25 Jul 2019
- Affected
- 3,081,321
- Data exposed
- Dates of birth, Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In July 2019, MGM Resorts found that someone had accessed one of its cloud services. MGM said the incident involved a limited amount of information about former guests. In February 2020 the data surfaced on a hacking forum, where ZDNet and the monitoring group Under the Breach reported it. MGM then confirmed the incident publicly.
Have I Been Pwned's entry describes 10.6 million guest records with 3,081,321 unique email addresses, stemming back to 2017.
What was exposed
The exposed data included email addresses, physical addresses, names, phone numbers and dates of birth. MGM said no financial, payment card or password data was involved, so there is no card number or password to change.
What that lets criminals do
A name, phone number, home address and date of birth together are a ready-made profile. Scammers use them for phishing and smishing that sounds personal, for SIM swap attempts where they pose as you to your phone carrier, and as raw material for identity theft. Some guests on the list were well known, which made them targets for targeted fraud too.
What to do
You can't pull data back from a forum once it's out there. Focus on the details that are still useful to criminals: be skeptical of messages that mention your stay, ask your mobile carrier for an account PIN, and check your credit if your date of birth could be misused.
What to do if you were in it
- 1
Expect personal-sounding phishing and texts
Your name, address and phone number were exposed, so scam messages may sound convincing. Don't click links; contact MGM or your bank directly.
- 2
Ask your carrier for an account PIN
With your phone number, name and date of birth, a criminal could try a SIM swap. A PIN or port-out lock on your mobile account makes that harder.
- 3
Watch your credit
A date of birth is a piece of the puzzle for identity theft. Check your reports at annualcreditreport.com, and consider a free freeze at Equifax, Experian and TransUnion.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the MGM Resorts breach?
Have I Been Pwned lets you check your email address. If you stayed at MGM properties up to 2017, your details may be in the data.
What was exposed?
Email addresses, physical addresses, names, phone numbers and dates of birth. MGM said no financial, payment card or password data was involved.
Should I change my password?
Passwords weren't part of this breach, so MGM's data doesn't force a change. If you reuse passwords across sites, changing them is still a good habit.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
