Canadians MGM Data Settlement: Here’s How to Claim Your Share of the $4 Million Payout

The way it played out was almost predictable. Millions of visitors’ personal information fell into the hands of strangers due to a major casino company, a string of cyberattacks, and years later, a settlement that asks everyone to quietly accept a check and move on.

The Canadian MGM data settlement, which is currently proceeding through the legal system, is one of those cases that appears to be well-resolved on paper but feels much messier when you consider what was actually taken.

Key Information	Details
Company	MGM Resorts International
Settlement Amount	CAD $4,000,000
Data Incidents	July 2019 & September 2023
Eligible Claimants	Canadian residents (excluding Québec for BC action)
Lead Law Firm	Diamond & Diamond Lawyers LLP
Maximum Individual Claim (Substantiated)	CAD $20,000
Unsubstantiated Loss – Single Incident	CAD $150 (up to $500)
Unsubstantiated Loss – Both Incidents	CAD $300 (up to $1,000)
Credit Monitoring Coverage	1 year, with up to CAD $1,000,000 fraud/identity theft insurance
Opt-Out Deadline	May 19, 2026
Objection Deadline	May 5, 2026
Settlement Approval Hearing	May 25, 2026 — Supreme Court of BC, 800 Smithe Street, Vancouver
Settlement Website	www.MGMDataSettlement.ca
Class Counsel Fees Sought	CAD $1,200,000 (from Settlement Fund)
MGM’s Position	Denies all liability; settled to avoid litigation costs

I’ll start over. MGM Resorts International found that hackers had gained access to its network in July 2019. Passport numbers, phone numbers, home addresses, and guest names were all disclosed. In what seemed to be a subtly telling move, MGM admitted the breach but delayed disclosing its full scope. Lawyers only later verified the figure—more than 37 million customers were impacted—through U.S. court filings. It’s not a rounding error. That dataset is the size of a city.

Then came September 2023. Another assault, ransomware this time. Additionally, if the 2019 breach felt intrusive, this one felt surgical because Social Security numbers, driver’s license numbers, and military ID numbers were allegedly accessed. the type of data that is not simply altered by changing the password. the type that follows an individual.

Class proceedings were filed in several jurisdictions, particularly for Canadians. Nikitta Thandi is named as the representative plaintiff in the British Columbia action Thandi v. MGM, which the Supreme Court of British Columbia has now certified for settlement purposes.

Additionally, separate actions were filed in Québec: Dahan v. MGM for 2023 and Zuckerman v. MGM for the 2019 incident. It is important to remember that residents of Québec will have to follow their own procedures because they are not a part of the BC settlement.

A CAD $4 million fund is the suggested resolution. Until you do some rough math, that sounds important. What’s left over after legal fees—Diamond & Diamond Lawyers LLP are requesting about $1.2 million, which is typical in class actions of this kind—administration costs, and disbursements is distributed among thousands of claimants. You may be eligible for a $20,000 claim if you have receipts and other proof of actual financial harm.

If you don’t have that kind of paper trail, which most people won’t, you could be fined $150 for a single breach or $300 if your data was impacted by both. The upside ceilings are $500 and $1,000, respectively, but only if there is still space in the fund after all legitimate claims have been tallied. This settlement may seem more like a formality than justice to a lot of people.

However, credit monitoring is available for a full year, along with up to $1 million in fraud and identity theft insurance upon request. That’s not insignificant, especially for those who have since struggled with the nagging worry that their passport number or license details might have been sitting on some forum.

After observing this field for a few years, it seems that data breach settlements seldom correspond with the real disruption they are intended to mitigate. This one is no different, but it’s also a legitimate way for actual people to get something back.

The procedure itself is quite simple. You will remain a class member by default if you do nothing before May 19, 2026, and you will be able to submit a claim after the settlement is approved by the court. You must submit an opt-out form by that date if you wish to completely withdraw. You must submit written objections to the terms to class counsel by May 5, 2026.

The final approval hearing is set for 10:00 a.m. on May 25, 2026. at the Supreme Court of British Columbia on Smithe Street in Vancouver, a courtroom that will probably feel very different from the hotel hallways and casino floors where millions of people unintentionally gave up the data that is now at the heart of it all.

For its part, MGM has made it clear that no court has found it liable and has denied all accusations. As the firm points out, the company decided to settle in order to avoid the expense and uncertainty of protracted litigation. That framing is likely accurate and compliant with the law. It’s a different matter entirely whether it adequately conveys what it means for a company to possess the passport numbers of 37 million people and then lose them.

It’s still unclear if the proposed settlement will be accepted or if the compensation amounts will change once the total number of claims is known. The deadline is important, that much is clear. Before May, anyone who believes their information may have been involved in the 2019 or 2023 incidents—such as previous stays at MGM hotels, memberships in loyalty programs, or visits to casinos—should at the very least check the settlement website. These things have a way of shutting quietly, and the window is getting smaller.