MGM Sues FTC to Stop Investigation into $100M Data Security Breach

FTC Chair Lina Khan is in the hot seat again, this time being sued by MGM Resorts in an effort to stop her investigation into MGM’s data security. (Image: SOPA/Alamy)

MGM Resorts International filed a lawsuit against the US Federal Trade Commission on Monday in an effort to stop the agency’s probe into the data security ramifications of the hack into the casino operator’s systems last year.

In the lawsuit, filed in the US District Court for the District of Columbia, MGM is seeking an injunction to stop the FTC from issuing a civil investigative demand as a part of its investigation into MGM’s data security unless FTC Chair Lina M. Khan recuses herself from the investigation.

MGM Accuses Khan of Conflict of Interest Due to Resort Visit 

The September attack against MGM Resorts took down many of the company’s computer systems. Several areas of the company were impacted, ranging from casino floor operations to email, reservations, and the functions of hotel key cards. According to MGM, the attack cost the company nearly $100 million.

In the lawsuit, MGM alleges that Khan and one of her senior aides have a conflict of interest because they were visiting the MGM Grand on Sept. 12, 2023, right as the cyberattack against MGM was taking place.

Just days later, Bloomberg reported that Khan and her aide had questioned at least one employee about MGM’s procedures during the incident.

“When Khan and her staff got to the front of the line, an employee at the desk asked them to write down their credit card information on a piece of paper,” the lawsuit states, quoting the Bloomberg report as a source. 

“As the leader of the federal agency that, among other things, ensures companies protect consumer data wrote down her details, Khan asked the worker: How exactly was MGM managing the data security around this situation? The desk agent shrugged and said he didn’t know, according to a senior aide who was traveling with Khan and described the experience to Bloomberg as surreal.”

-- MGM lawsuit

MGM alleges not only that Khan’s presence creates a conflict of interest related to the case, but also that the publicity her experience received ultimately caused material harm to the company.

“MGM’s misfortune that day was compounded by the presence of a powerful public figure at its Las Vegas hotel during the attack,” the lawsuit states. 

Lawsuit Questions Investigation on Multiple Fronts

A civil investigative demand (CID) allows a federal agency – in this case, the FTC – to request significant information from companies without going through court processes. MGM is accusing the FTC of violating the company’s Fifth Amendment rights to due process in relation to the commission’s swift dismissal of two petitions made by the company in relation to the investigation.

“The Due Process Clause of the Fifth Amendment affords parties subject to government enforcement actions a fair hearing before an impartial tribunal and guarantees them equal treatment under the law,” the lawsuit reads.

MGM is also objecting to the FTC’s investigation on the grounds that the casino operation is not a financial institution, and as such shouldn’t be subjected to the FTC’s rules related to data security for such institutions. The FTC has claimed that MGM qualifies because it issues credit in the form of “markers” to high rollers.

Finally, even if MGM should lose in court and the FTC can continue its investigation, it still wants the court to set a deadline for it to respond to the CID. The company has already requested an extension from the FTC due to the broad nature of the information requested, with MGM saying the FTC is asking for multiple years of data in more than 100 categories, much of which MGM thinks is irrelevant to the cyberattack. The FTC denied that extension.