MGM sues to block FTC investigation of its data security

MGM Resorts International has sued the Federal Trade Commission in an attempt to quash an investigation into its data-security practices, claiming the agency’s requests are unconstitutional and that FTC Chair Lina Khan should recuse herself from the case since she happened to be staying at an MGM hotel in Las Vegas at the time of the cyberattack that prompted the probe.   

The lawsuit filed Monday in Washington, D.C., follows several months of back-and-forth between the agency and the hotel and casino chain, which suffered a debilitating cyberattack in September 2023. The breach by hackers affiliated with the group Scattered Spider knocked out systems for days and compromised sensitive information. 

MGM said the incident cost about $100 million last year, and it is now facing 15 consumer class action lawsuits. 

According to media reports, when checking into an MGM Resorts hotel Khan was asked to write her credit card information on a piece of paper since its IT systems were down. 

She reportedly asked the hotel employee how the company was handling data security during the incident, which was met with a shrug. 

“Chair Khan’s query to the desk clerk was soon followed up with a wide-reaching FTC investigation,” the suit claims. The agency filed a Civil Investigative Demand on January 25 “seeking a response to the unanswered question Chair Khan reportedly posed to the desk clerk that day, and a great deal of additional information.”

As “the most visible witness and potential plaintiff” in litigation related to the incident, MGM claims, Khan should not be allowed to preside over the FTC’s investigation.

According to the company, the FTC requested information on more than 100 different areas over several years, and claimed to do so to ensure MGM’s compliance with data security rules applying to financial and credit-issuing institutions.

MGM Resorts says rules for financial institutions do not apply to it since the company does not technically issue credit. In certain instances, it said, the casino operator issues “markers” to select customers giving them advance access to funds. 

“But these markers are the equivalent of a post-dated check as opposed to advancing funds through a line of credit,” they claim. 

MGM Resorts filed petitions with the FTC to quash the investigation and to recuse Khan from the investigation, both of which were denied. On April 4, the company was given an 11-day deadline to hand over the requested materials. 

The lawsuit contends that the FTC’s actions violate MGM’s Fifth Amendment rights to due process, which “requires that Chair Khan not be involved in Commission decisions regarding a matter in which she has a personal interest in the outcome.”  

“FTC commissioners, like Chair Khan, perform a quasi-judicial role.  And it is just as imperative for Commissioners to avoid even the appearance of unfairness as it is for federal judges,” they said.