MGM Resorts takes legal action vs US FTC over cyber-attack probe

Jenny Ortiz April 16, 2024

SiGMA news

MGM Resorts takes legal action vs US FTC over cyber-attack probe

MGM Resorts has escalated its battle with the United States Federal Trade Commission (FTC) by filing a lawsuit challenging the agency’s investigation into a cyber-attack that targeted the gaming giant last September. The lawsuit, filed in the US capital on Monday, alleges that the FTC’s actions represent an overreach and infringe upon MGM’s rights.

Impact of the cyber-attack

According to the lawsuit, the cyber-attack in September left MGM Resorts grappling with operational disruptions, forcing the company to temporarily operate its business without access to crucial IT systems essential for maintaining its renowned standards across its casinos and resorts.

Dispute over FTC jurisdiction

MGM contends that it should not be subjected to FTC regulations about consumer financial data, as it is not a financial institution. The lawsuit underscores the company’s objection to the FTC’s involvement, particularly given the personal connection of FTC Commissioner Lina Khan to the incident. Bloomberg reported that Khan was present at an MGM hotel during the cyber-attack, prompting MGM to call for her recusal from the proceedings.

FTC’s demands and deadline

The lawsuit highlights MGM’s objection to the extensive demands made by the FTC, including the production of over 100 categories of information. MGM argues that certain enforcement actions pursued by the FTC have never been targeted at a casino operator of its stature. Moreover, the company challenges the 11-day deadline imposed by the FTC to comply with a Civil Investigative Demand (CID), labeling it as “plainly unreasonable” and arguing that the CID was based on rules that are irrelevant to MGM’s operations.

Financial fallout and legal challenges

The aftermath of the cyber-attack has inflicted significant financial losses upon MGM Resorts, with reported costs exceeding $100 million (€94.2 million) in lost revenue and damages. Additionally, the company is contending with over a dozen consumer class action lawsuits stemming from the incident.

The attack disrupted IT systems at MGM’s US-based hotels and casinos, resulting in operational chaos such as slot machine shutdowns, malfunctioning mobile and door keys, and resorting to manual room check-ins.

MGM Resorts’ global operations

MGM Resorts, the parent company of MGM China, operates two integrated resorts in Macau through its subsidiary. The legal dispute with the FTC underscores the complexities and challenges faced by multinational corporations operating in the gaming industry.

Upcoming SiGMA event: BIS SiGMA Americas 2024, find all the details here.