MGM Resorts (2022 Update) Data Breach (2019): What Was Exposed & What To Do

In July 2019, MGM Resorts reported a data breach that affected 24.8 million people. The incident involved records from one of the company’s cloud services and included names, email addresses, physical addresses, phone numbers, and dates of birth.

Portions of the data had already appeared for sale on underground marketplaces by mid-2020. A larger collection surfaced publicly in May 2022, though investigators have linked it to the original 2019 event.

What happened

MGM Resorts stated that it discovered the breach on July 25, 2019. The initial disclosure described 10.6 million guest records containing 3.1 million unique email addresses, with some records dating to 2017. In May 2022, a superset of the data—nearly 25 million unique email addresses across 142 million rows—was shared on Telegram. Public reporting indicates that 142 million records from the same source had been offered for sale on a dark web marketplace in mid-2020.

No further technical details about the intrusion method or the exact number of affected individuals have been released by the company.

How a breach like this happens

Incidents involving cloud-hosted customer databases often begin with the compromise of an access credential or an unpatched service endpoint. Once inside the environment, an attacker can copy large volumes of stored records without triggering immediate detection. The data may then remain in the hands of the initial intruder or be resold through multiple channels over subsequent months or years.

Because cloud services frequently aggregate records from different time periods, a single compromise can surface data collected across several years when the material later circulates.

About MGM Resorts (2022 Update)

MGM Resorts operates hotels, casinos, and entertainment properties that collect personal information from guests as part of reservation, loyalty, and marketing activities. Such organizations routinely store contact details, identification data, and transaction histories to manage bookings and comply with regulatory requirements in the hospitality and gaming sectors.

A breach at a company of this scale is consequential because the records are tied to individuals’ travel patterns and financial relationships, creating long-term value for anyone seeking to misuse the information.

What was likely exposed

The records confirmed as exposed contain dates of birth, email addresses, names, phone numbers, and physical addresses. The company has not published a complete inventory of every field present in the dataset, so the presence of additional information such as payment card details or loyalty-program identifiers remains unconfirmed.

What's at stake

Individuals whose records were included face an elevated risk of receiving targeted phishing messages and unsolicited marketing that uses accurate personal details to appear legitimate. The combination of names, addresses, and dates of birth can also support identity-verification attempts at other services.

For the organization, the incident adds to existing regulatory scrutiny in the hospitality sector and may increase costs associated with customer notification, legal defense, and security remediation.

If your data was in this breach

Begin by monitoring email accounts for unexpected login attempts and enabling multi-factor authentication wherever it is offered. Review bank and credit-card statements for unrecognized activity and consider placing a credit freeze if you have not already done so.

Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other publicly documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.