MGM Resorts sues FTC, agency chair over cyberattack investigation

The lawsuit also seeks reimbursement of court costs and other damages the court identifies.

MGM’s computer systems were attacked in September by hackers seeking a ransom payment. At the direction of federal investigators, MGM refused to pay the ransom.

During the cyberattack, hundreds of slot machines were inoperative, guests could not access their rooms with smartphones and credit-card payment systems were disrupted, leading to the manual processing of credit-card transactions.

Among the guests were Khan and an aide, who were in Las Vegas for a conference.

On Sept. 15, Bloomberg reported Khan and the aide questioned MGM’s procedures during the cyberattack.

“When Khan and her staff got to the front of the line, an employee at the desk asked them to write down their credit card information on a piece of paper,” the lawsuit says, citing the Bloomberg report. “As the leader of the federal agency that, among other things, ensures companies protect consumer data wrote down her details, Khan asked the worker: How exactly was MGM managing the data security around this situation? The desk agent shrugged and said he didn’t know, according to a senior aide who was traveling with Khan and described the experience to Bloomberg as surreal.”

CID filed in January

Four months later, on Jan. 25, the FTC filed its civil investigative demand.

To MGM, the information requested mirrored Khan’s experience in Las Vegas.

“The voluminous requests posed by the CID closely track the events involving Chair Khan, with certain requests seemingly derived directly from Chair Khan’s personal experience in transacting business with MGM during the attack,” the lawsuit says.

MGM had telephone conferences with the FTC’s Los Angeles field office in the weeks ahead, and on Feb. 20 MGM filed a petition to quash or modify the CID. The company was given 11 days to compile the requested data.

The company then filed a petition seeking the recusal of Khan from the proceedings.

On April 1, the commission issued a single order denying both petitions. The commission says its Rules of Practice do not allow the recusal of commissioners except from administrative litigation.

“This categorical refusal to hear petitions to recuse or disqualify — even in extreme cases like this one — violates the Due Process Clause of the Fifth Amendment,” the lawsuit says.

___