FTC Close to Dropping MGM Cyberattack Investigation

The Federal Trade Commission may be on the verge of dismissing its case against MGM Resorts International, related to a cyber breach that occurred in 2023 involving the casino company. 

In a message to MGM’s legal team in Washington last Friday, the commission announced it will stop its civil investigative demand (CID) that was issued to MGM in January 2024. The CID was submitted under the leadership of former FTC Chairwoman Lina Khan and prompted backlash from MGM, which included a countersuit asking for Khan to step down. 

That demand arose from the chance that Khan and some FTC staff were staying at the MGM Grand on the Las Vegas Strip when the cybersecurity incident took place in September 2023. Hotel personnel at the integrated requested Khan and the FTC staff to jot down their credit card details on slips of paper, raising intrigue about the situation. 

In its lawsuit filed in April 2024 against the commission, MGM contended that Khan's decision not to step aside from the case, along with the commission’s failure to compel her to do so despite her being a guest at MGM Grand during the data breach, infringes upon its Fifth Amendment rights. The gaming company asserted that Khan took part in the hearing related to her involvement in the case against MGM. 

MGM Happy FTC Is Ending CID 

FTC officials did not reply to a comment request from Casino.org, but MGM informed Las Vegas media about the situation, expressing satisfaction with the withdrawal of the CID.

"The CID issued by the former chair of the FTC was a dangerous overreach that sought to punish MGM Resorts for refusing to pay cybercriminals,” said the gaming company in a statement provided to The Las Vegas Review-Journal. “We’re pleased that the new chair has withdrawn it.”

MGM argued that the FTC was overstepping by claiming that the commission's Red Flag and Safeguards regulations did not apply to the gaming firm. These guidelines are generally utilized by financial services firms. Under previous leadership, the FTC sought to apply those regulations to MGM by arguing that, as lenders to certain clients, casino operators function as financial services companies. 

Currently, it remains uncertain why the commission is shutting down the CID, but the FTC is being led by Chairman Andrew Ferguson. President Trump appointed him. A 2024 spending bill sanctioned by the House Appropriations Committee — one pushed by a congressman who received campaign donations from MGM — included a clause that would have eliminated the CID, but it’s uncertain if that influenced the FTC's recent ruling. 

MGM Hack Recap 

The September 2023 assault, carried out by a collective of hackers called “Scattered Spider,” led to a $100 million blow to MGM’s third-quarter profits that year, in addition to $10 million in one-time costs. 

That group similarly focused on Caesars Entertainment around the same period, but Caesars decided to pay the hackers up to $30 million to avoid further complications. In line with FBI guidelines, which advise victims against compensating malicious actors, MGM did not provide Scattered Spider any payment. 

In January, the United States District Court for Nevada gave preliminary approval for a $45 million settlement in a class action lawsuit filed against the gaming company due to the cybersecurity breach.