FTC Close to Dropping MGM Cyberattack Investigation

Posted on: March 2, 2025, 04:26h. 

Last updated on: March 2, 2025, 04:26h.

Todd Shriber @etfgodfather Read More
Expertise: Financial, Gaming Business, Mergers and Acquisitions.
  • FTC no longer pursuing civil investigative demand
  • Could mark end of case brought against MGM in January 2024

The Federal Trade Commission could be close to dropping its case against MGM Resorts International, which stems from a 2023 cyber intrusion carried out against the casino giant.

The Federal Trade Commission (FTC) building in Washington, DC. The commission is dropping its CID against MGM. (Image: Investopedia)

In a letter to MGM’s Washington-based legal team last Friday, the commission said it will halt its civil investigative demand (CID) issued to MGM in January 2024. The CID was filed during former FTC Chairwoman Lina Khan’s tenure and sparked rebuke from MGM, including a countersuit in which the gaming company requested that Khan recuse herself.

That demand was born out of the coincidence that Khan and several FTC employees were guests of the MGM Grand on the Las Vegas Strip at the time the September 2023 cybersecurity incident occurred. Hotel staff at the integrated asked Khan and the FTC employees to write their credit card numbers on pieces of paper, sparking curiosity about what was happening.

In its April 2024 suit against the commission, MGM argued that Khan’s refusal to recuse herself from the case, and the commission’s refusal to force her to do so despite her being a guest of MGM Grand during the data breach, violates its Fifth Amendment rights. The gaming company also claimed that Khan participated in the hearing pertaining to her participation in the case against MGM.

MGM Pleased FTC Is Dropping CID

Officials from the FTC did not respond to a request for comment from Casino.org, but MGM updated Las Vegas media on the matter, noting it’s happy about the withdrawal of the CID.

The CID issued by the former chair of the FTC was a dangerous overreach that sought to punish MGM Resorts for refusing to pay cybercriminals,” said the gaming company in a statement provided to The Las Vegas Review-Journal. “We’re pleased that the new chair has withdrawn it.”

MGM’s argument that the FTC was pushing boundaries was rooted in the argument that the commission’s Red Flag and Safeguards statutes weren’t applicable to the gaming company. Those guidelines are typically applied to financial services companies. Under prior leadership, the FTC attempted to leverage those rules against MGM on the basis that as extenders of credit to some clients, casino operators are de facto financial services firms.

At this point, it’s not clear why the commission is killing the CID, but the FTC is under leadership with Chairman Andrew Ferguson at the helm. He was appointed by President Trump. A 2024 spending bill approved by the House Appropriations Committee — one advanced by a congressman that received campaign contributions from MGM — featured a provision that would’ve killed the CID, but it’s not clear if that had anything to do with the FTC’s recent decision.

MGM Hack Rewind

The September 2023 attack, perpetrated by a group of hackers known as “Scattered Spider,” resulted in a $100 million hit to MGM’s third-quarter earnings that year along with $10 million in one-off expenses.

That group also targeted Caesars Entertainment around the same time, but Caesars opted to pay the hackers as much as $30 million to prevent the situation from escalating. In accordance with FBI guidelines, which urge victims to not pay bad actors, MGM offered Scattered Spider no such compensation.

In January, the United State District Court for the District of Nevada granted preliminary approval of a $45 million settlement in a class action suit brought against the gaming company as a result of the cybersecurity incident.