MGM Resorts Data Breach (2019): What Was Exposed & What To Do

MGM Resorts reported a data breach on July 25, 2019, that affected records belonging to 3.1 million individuals. The incident involved one of the company’s cloud services and exposed 10.6 million guest records containing 3.1 million unique email addresses, some dating back to 2017. The data later appeared on a hacking forum in February 2020 and was redistributed from there. The records were supplied to Have I Been Pwned by the source Under The Breach. This event is notable because it involved a large hospitality operator and touched personal details that many people provide when making hotel reservations or loyalty-program enrollments. The subsequent public posting of the material increased the chance that the information would be used for further contact or correlation with other data sets.

What happened

According to the available reports, MGM Resorts discovered unauthorized access to a cloud service in July 2019. The compromised material consisted of 10.6 million guest records that included 3.1 million distinct email addresses. The records originated as far back as 2017. No further technical details about the initial access method or the duration of exposure have been released publicly.

The same data set was later posted on a popular hacking forum in February 2020 and circulated from that location. The incident record was contributed to Have I Been Pwned by the group Under The Breach.

How a breach like this happens

Incidents involving cloud-hosted customer databases often begin with the compromise of an application credential, an exposed storage bucket, or an unpatched service interface. Once access is obtained, attackers can copy large volumes of records without triggering immediate detection if logging or monitoring is limited. The data may then be packaged and offered or shared on forums, where it circulates independently of the original intrusion.

About MGM Resorts

MGM Resorts operates hotels, casinos, and entertainment properties that maintain extensive guest databases. These systems routinely store contact information, identification details, and transaction histories to support reservations, loyalty programs, and regulatory requirements. A breach at an organization of this scale can affect millions of individuals because the data is collected at high volume and retained for operational and compliance purposes.

What was likely exposed

The records that were reported as accessed contained the following categories of information:

• Dates of birth
• Email addresses
• Names
• Phone numbers
• Physical addresses

Exact field lists and record counts beyond the headline figures remain unconfirmed by the company.

What's at stake

Individuals whose details appeared in the data set face an elevated risk of receiving unsolicited messages and of having their information combined with other publicly available or previously breached records. Such combinations can support more targeted phishing or account-recovery attempts. For the organization, the incident adds to the body of known exposures that may be referenced in future regulatory reviews or insurance assessments, though the direct financial or legal consequences have not been detailed in public statements.

What to do if you're exposed

Review any email accounts associated with MGM properties for unusual login activity and enable multi-factor authentication where available. Monitor statements from financial institutions and loyalty programs for unexpected changes. Consider using a password manager to replace any reused credentials. Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.