The Federal Trade Commission (FTC) has filed a petition with a federal court asking it to force MGM Resorts to comply with a request for information regarding a cyber attack that was launched against the company in September.
Investigation Proclamation
MGM Resorts International experienced a data breach in 2019 and then a cyber attack in September 2023 that also affected Caesars. Although MGM has reported it did not pay any ransom in the ransomware case, the FTC is investigating the attack and has been requesting information from MGM that it has failed to deliver.
The latest development shows the FTC petitioning the U.S. District Court in Nevada to compel MGM to adhere to its Civil Investigative Demand (CID) within 10 days of the court order. Due to the company’s security breaches, the governmental body seeks to review its security practices and protocols. The FTC’s petition reads as follows:
“Judicial enforcement is necessary so that FTC staff may thoroughly and expeditiously conduct its investigation. The FTC respectfully asks this court to issue an order requiring MGM to appear and show cause why it should not comply with the CID and thereafter grant the FTC’s petition and enter an order compelling MGM to produce the documents and information specified in the CID.”
But this recent legal maneuver came after MGM filed a lawsuit in April against the FTC and its chairwoman, Lina Khan, in the District of Columbia District Court. In a coincidental twist, Khan and an aide were staying at the MGM during the cyber attack and the lawsuit seeks to dismiss her from the investigation. It has been reported that Khan questioned MGM’s security practices and procedures upon which the CID was subsequently issued on January 25th.
The security breach cost the company a reported $100 million.
Constitutional Breach
MGM is also challenging the constitutionality of the FTC’s Rules of Practice regarding Petitions to Recuse Commissioners. The company seeks exemption to the FTC’s “Red Flag Rule” and the “Safeguards Rule”. The former demands that companies formulate an identity theft prevention program while the latter compels companies to develop an information security protocol.
MGM is also requesting additional time to respond to the requests if they are required to do so as the information requested by the CID would span hundreds of categories over several years. MGM Resorts asserts that ferreting out that information and ultimately delivering it to the FTC would require more time than the FTC has allowed.
“We’ve worked with federal law enforcement from the outset and followed the government’s guidance by refusing to pay a ransom and reward criminals for their horrendous actions,” the report cited an MGM spokesman. “The idea that the government would threaten and punish victims for doing so sends a dangerous message that emboldens criminals and threatens national security. Our suit against the FTC to protect our rights under due process is still pending.”
The original CID request specified April 15th as the deadline to get the FTC the information it required but after several unsuccessful attempts to get MGM to comply, the governmental body filed the lawsuit to force the company’s compliance.
