Share
For MGM Resorts, the fallout could soon diminish over a September 2023 cyberattack on systems that the company used to process payments and store customers’ data. The Federal Trade Commission (FTC) has moved to end its investigation of MGM’s handling of the situation and a lawsuit to force MGM to comply with that investigation.
In response, MGM may withdraw its lawsuit against the FTC, which would be a significant step in bringing the matter to a close. Even with the potential avoidance of government penalties, the incident has cost MGM millions of dollars.
FTC, MGM notify court of developments
On Feb. 28, a filing in MGM’s lawsuit against the FTC from both parties updated the court that the two parties are near a resolution of the dispute that may lead to MGM withdrawing the complaint. The updates involved actions on the FTC’s part.
On Feb. 26, the FTC informed MGM that it had withdrawn its civil investigative demand against MGM. A civil investigative demand is like a subpoena for information but does not come with the enforceability of an actual subpoena because it is part of civil, not criminal, proceedings.
The FTC had been seeking information from MGM related to a cybersecurity incident that affected most of the company’s computer systems for 10 days in September 2023. Concerns involved breaches that exposed customers’ financial and identity data.
In the same Feb. 26 correspondence, the FTC also expressed that it would drop its lawsuit in which it asked a federal court to compel MGM to comply with the demand. Pending that withdrawal, the Feb. 28 filing states “the parties expect to meet and confer about the status of the investigation…in the very near future.”
MGM has an active complaint against the FTC, alleging that the commission has overstepped its authority and failed to follow procedures in its actions against MGM. Should both lawsuits be withdrawn, it would mean MGM is close to putting the 2023 cyberattack in the rearview mirror.
The timing of the resolution suggests that the recent change in federal administration has a lot to do with the cessation of legal action.
New administration seems uninterested in pursuing investigation
The second Donald Trump Administration replaced former FTC chair Linda Khan with Andrew Ferguson. Khan personally experienced the September 2023 cyberattack during a stay at an MGM property in Las Vegas according to Richard N. Velotta of the Las Vegas Review-Journal.
The investigative demand followed shortly thereafter and Khan’s service as chair of the FTC is one of the issues that MGM points to in its lawsuit against the FTC. MGM argues that Khan’s role as a witness to the incident impairs the objectiveness of the actions.
The FTC’s move to drop the investigation under Ferguson’s leadership follows a July 2024 move by Republicans in Congress to prevent the FTC using its funding to investigate gaming and hospitality companies using the Red Flags Rule and the Safe Guards Rule. Those legal standards were the exact rules that the FTC had invoked to initiate the investigation into MGM.
MGM also argues in its complaint that the FTC has no authority to investigate it because it is a gambling and hospitality company, not a financial institution. The FTC used those rules to argue for its jurisdiction because MGM extends markers to players for them to use while gambling in lieu of cash.
While the immediate threat of action against MGM by the US government looks to be averted, MGM claimed that the 2023 cyberattack cost it $100 million. That cost may not be final yet as MGM is still working out a settlement with people whose data was exposed during the incident.
While all the potential impacts of Trump’s second tenure as US president on the gambling industry are still to be determined, this development appears to be a positive for MGM.
