The Federal Trade Commission (FTC) filed a petition in Nevada District Court on Monday (17 June), attempting to force MGM Resorts to cooperate with its cyberattack probe.
The FTC asked the court to order MGM to hand over documents and information related to its previously announced investigation into whether the operator’s data security practices were in line with the Commission’s requirements.
It follows MGM’s April legal bid to block the investigation, where it argued the probe was a personally motivated over-reach triggered by the FTC chair’s stay at an MGM property during the cyberattack.
The government agency is requesting the court issue a summary judgement enforcing MGM’s compliance with its civil investigative demand, known as a CID.
The lawsuit said: “To impede the Commission’s investigation, MGM has refused to comply with the CID and filed a declaratory judgment lawsuit attempting a pre-emptive strike against an FTC action to enforce the CID.
“The FTC will respond to that filing in due course and show why MGM’s suit is improper.
“But nothing that MGM alleges in that complaint or that MGM might claim here undermines the FTC’s authority to obtain in this proceeding the information it needs for its investigation.”
FTC highlights multiple MGM data breaches
MGM Resorts’ customer data, including some social security numbers, was obtained by hacker groups after its systems were breached in a September 2023 cyberattack.
The FTC highlighted that MGM has suffered at least two additional data breaches since 2019 that have led to stolen customer information.
The investigation, which opened after the latest attack, aims to examine whether MGM’s data security and privacy practices represent “unfair or deceptive acts or practices in or affecting commerce” in violation of the FTC Act.
“We’ve worked with federal law enforcement from the outset and followed the government’s guidance by refusing to pay a ransom and reward criminals for their horrendous actions,” an MGM spokesman told the Las Vegas Review Journal on Tuesday.
“The idea that the government would threaten and punish victims for doing so sends a dangerous message that emboldens criminals and threatens national security. Our suit against the FTC to protect our rights under due process is still pending.”
The FTC sought to prove in the complaint that the investigation is within its authority and that MGM had no valid basis for refusing to comply with the CID.
The September 2023 cyberattack saw hackers breach MGM’s systems and demand a ransom from the business.
In the following days MGM systems, including slots machines and digital key cards, broke down at multiple properties.
The outages lasted approximately 10 days, after which MGM issued a statement that systems were operating normally although “intermittent issues” may still be affected.
The company ultimately experienced a $100m hit to EBITDA from the incident.
MGM is also facing multiple class action lawsuits alleging negligence surrounding its data security practices.
[stock_market_widget type=”inline” template=”generic” assets=”MGM” markup=”{name} ({symbol}) is trading at {price} ({change_pct})” api=”yf”]
