Executive Summary: Key Legal and Evidentiary Issues

• Two data breaches of MGM Resorts International's systems — one in July 2019 and another in September 2023 — gave rise to consolidated class action proceedings before the Quebec Superior Court.
• A proposed $4,000,000 settlement was rejected as not fair, equitable, or in the fundamental interest of class members estimated to number in the millions.
• Disproportionate legal fees of $1,200,000 (plus taxes) relative to the negligible financial benefit offered to members raised serious concerns about the integrity of the settlement.
• The sweeping scope of the release — extinguishing unknown and future claims for members who received little or no compensation — weighed heavily against approval.
• Evidentiary obstacles remained significant, as class counsel had not conclusively established that any personal information was compromised or misused by a third party.
• Residual funds designated for charities with no connection to the subject matter of the litigation, selected based on counsel's personal preference, were found to be improper.

Facts of the case

Evan Zuckerman and Marc Dahan commenced separate class actions against MGM Resorts International arising from two distinct cybersecurity incidents. The first occurred around July 7, 2019, when an unauthorized third party accessed MGM's computer systems and allegedly obtained the personal and confidential information of class members. The Quebec Superior Court authorized the Zuckerman class action on August 3, 2022. A second breach occurred in September 2023, with Marc Dahan acting as representative plaintiff. Parallel proceedings were also initiated in British Columbia and Ontario in relation to the first incident; the Ontario action was subsequently abandoned, while the British Columbia action — known as the Thandi matter — was incorporated into the present settlement. On April 8, 2026, the court authorized the Dahan class action solely for the purposes of settlement and approved pre-approval notices to members. Concilia Services Inc. was designated as the claims administrator.

Settlement terms at issue

The parties entered into a settlement agreement on November 13, 2025, subsequently amended by addendum on March 6, 2026 (collectively, the "Transaction"). The Transaction was intended to resolve all claims by Canadian class members across all related proceedings. The total settlement fund was $4,000,000. Claims were structured into three categories: undocumented claims (capped at $150 per member for one incident, or $300 for members involved in both the 2019 and 2023 incidents), documented claims (capped at $20,000 each and paid in priority), and credit monitoring expenses incurred after the claim period commenced, reimbursable for a maximum of one year from the date a member submits a claim form. No separate funds were set aside for each category — a single settlement fund governed all claims, with documented losses taking priority. The Transaction also provided that each of the two Quebec representative plaintiffs could claim up to $15,000 without supporting documentation, subject to court approval. Any residual funds not distributed to members were to be allocated in part to the Fonds d'aide aux actions collectives, based on an estimated 8.4% proportion of Quebec members, with remaining surplus directed to Chai Lifeline Canada, the Jewish General Hospital, and L'Institut du Cancer de Montréal.

Court's reasoning and analysis

The court applied the six-factor framework under Article 590 of the Code of Civil Procedure, as affirmed in A.B. c. Clercs de Saint-Viateur du Canada, 2023 QCCA 527, to assess whether the Transaction was fair, equitable, and in the fundamental interest of class members. The court found the Transaction fell short on nearly every measure.

On membership and quantum, the court noted significant inconsistencies in the estimated class size. Concilia's initial estimate placed the total at 2,906,563 members, but the court calculated a figure of approximately 3,844,039 when combining members with and without email addresses. Class counsel's own breakdown — identifying 1,963,563 members exclusively in the 2019 incident, 2,610,189 exclusively in the 2023 incident, and 1,667,402 members in both — yielded a potential total of 6,261,154, nearly double Concilia's figure. The court found the $4,000,000 fund grossly inadequate relative to these numbers. Under the most optimistic scenario involving only undocumented claims, a maximum of 15,635 members — just 0.25% of the class — could receive $150 each once Interac transfer fees were deducted. Alternatively, if the fund were distributed proportionally across 500,000 members, each would receive approximately $0.85 — a figure the court described as ridiculously low.

On legal fees, the court found that counsel's fees of $1,200,000 (plus taxes, totalling $1,378,800) were wholly disproportionate to the benefit delivered to members. After deducting those fees, disbursements of $62,168.82, and estimated claims administration fees of $134,635.73, the theoretical maximum available for distribution to members was $2,423,495.45 — already insufficient, and subject to further reduction by payment processing costs. The court drew on Walid c. Compagnie Nationale Royal Air Maroc, 2024 QCCS 2674, where approval was refused in part because counsel's fees risked exceeding the amount ultimately distributed to members — a risk the court found equally present here.

On the release, the court found its scope disproportionately broad. Members who received little or no compensation — including those who may never have been notified of the settlement — were required to permanently release all known and unknown claims, including future claims arising from the same data breaches. The court observed that stolen data may be misused years later, potentially causing identity theft or other serious harm, and that members would be foreclosed from pursuing such claims once the release took effect.

On the credit monitoring benefit, the original settlement had envisioned a one-year credit monitoring program comparable to that offered to American class members. However, the anticipated provider demanded nearly $1,000,000 simply to establish the program, regardless of participation — a cost the parties considered excessive given the $4,000,000 total fund. The parties amended the Transaction to require members to independently procure and pay for credit monitoring services, subject to later reimbursement from the settlement fund. The court found this placed an unfair burden on members and reflected inadequate pre-settlement due diligence. By comparison, the court referenced the Desjardins data breach settlement (Boulay c. Fédération des Caisses Desjardins du Québec, 2022 QCCS 2301), in which a fund of up to $200,852,500 was established for approximately 4,200,000 individuals, with Desjardins separately funding five years of Equifax credit monitoring at no cost to members. The court also cited Condon c. Canada, 2018 CF 522, where a $17,500,000 fund was approved for a class of 583,000 members, accompanied by an uncapped supplementary fund for actual losses — both settlements standing in stark contrast to the Transaction at hand.

On the cy-près allocation, the court rejected the designation of Chai Lifeline Canada as a residual beneficiary on the basis that it had no connection to the subject matter of the litigation. Counsel's explanation that it was a cause personally important to him was found to be an improper basis for directing members' funds.

On proof and litigation risk, the court observed that class counsel had not yet conclusively established that any personal information was compromised or misused. Under Quebec civil law, a mere risk of future harm does not constitute compensable damage; actual prejudice must be demonstrated, per Article 1611 of the Civil Code of Quebec. The court acknowledged this created real litigation risk for the plaintiffs, but found that risk insufficient to justify approving a settlement that provided minimal benefit in exchange for a permanent and sweeping release.

Ruling and outcome

The court, per the Honourable Justice Pierre Nollet, J.C.S., rejected the application to approve the Transaction on June 10, 2026, on the basis that the settlement was not fair, equitable, or in the fundamental interest of class members, and that its approval would risk bringing the administration of justice into disrepute. The proposed post-approval notice and counsel's fees were also not approved. No costs were awarded. The court ordered the parties to submit, within thirty days of the judgment, a draft notice to members advising them of the refusal to approve the Transaction, a dissemination program for that notice, and a draft procedural protocol for the continuation of the Dahan and Zuckerman proceedings. As no settlement was approved, no monetary award, damages, or costs were granted to any party.