MGM and FTC continue to battle cybersecurity incident in court

FTC building statue
Image: Shutterstock / Rosemarie Mosteller

While the Federal Trade Commission advances its own court complaint in the Nevada District Court, it filed a motion to dismiss the suit filed against the organization by MGM Resorts in the D.C. District Court.

MGM first filed the lawsuit in April. In the complaint, the casino company said the FTC refused to grant its petition to quash an FTC investigation into the company’s 2023 cybersecurity incident and that FTC Chair Lina Khan, in MGM’s opinion, wrongly refused to recuse herself from the matter.

In its motion to dismiss, the FTC argued that MGM does not have standing to file suit, in large part, because there has been no action by the FTC that the company can legally respond to. The company has yet to comply with the investigation request but the FTC has not levied any sort of punishment against the company.

“Simply put, MGM has refused to comply with the Demand. Instead, MGM preemptively sued the Commission for pre-enforcement declaratory relief. MGM’s suit fails, however, both for lack of subject matter jurisdiction and for failure to state a claim for relief,” the motion stated.

The FTC also argued that the agency is the first step in due process, not the court, so the group suggests the court lacks standing to act on this issue.

As for Khan’s refusal to recuse herself, the FTC said that simply because Khan was a guest at an MGM property when the cyberattack took place was not sufficient reason for her to step back and that MGM’s suggestion she had “pre-existing” knowledge of the incident was overstating the facts.

Meanwhile, MGM Resorts has filed its own action in Nevada, claiming the agency is improperly attacking the company in a new venue with pending litigation in the D.C. court. It is seeking to have the FTC’s complaint either dismissed or transferred over to the venue where the initial litigation was filed.