MGM Resorts data breach: 3.1M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2020-02-20
In July 2019, MGM Resorts discovered a data breach of one of their cloud services. The breach included 10.6M guest records with 3.1M unique email addresses stemming back to 2017. The exposed data included email and physical addresses, names, phone numbers and dates of birth and was subsequently shared on a popular hacking forum in February 2020 where it was extensively redistributed. The data was provided to HIBP by Under The Breach. Exposed data: dates of birth, email addresses, names, phone numbers, physical addresses. The breach dates from Jul 25, 2019; Have I Been Pwned loaded it on Feb 20, 2020.
What to do
- If you had a MGM Resorts account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
