The FTC had been investigating MGM’s data security practices following a high-profile cyberattack in September 2023 which disrupted the company’s operations and reportedly affected customer data.

According to court filings submitted on 28 February, both the FTC and MGM agreed to dismiss the case without prejudice, with each party bearing its own legal costs.

The decision effectively ends the federal agency’s efforts to compel MGM to comply with a broad investigative request related to its cybersecurity measures and response to the cyberattack.

Case background: FTC tries to enforce CID

The FTC launched its probe into MGM after a cybersecurity breach in September 2023 forced the company to shut down key IT systems, disrupting operations across its properties.

The breach reportedly led to a widespread system failure, affecting hotel check-ins, casino operations, and customer transactions.

Among those inconvenienced was FTC chair Lina Khan, who was staying at an MGM property at the time of the incident.

The FTC issued a CID to MGM on 25 January 2024, citing concerns that the company may have violated consumer protection laws by failing to implement adequate security measures.

Specifically, the FTC sought information to determine whether MGM’s practices complied with Section 5 of the FTC Act, the Safeguards Rule under the Gramm-Leach-Bliley Act, and the Red Flags Rule under the Fair Credit Reporting Act.

The antitrust and consumer protection agency subsequently launched a lawsuit to enforce the CID.

MGM, however, resisted the FTC’s demands, arguing that the agency lacked jurisdiction over its business and that the investigation was tainted by bias.

In April 2024, MGM filed a lawsuit against the FTC in the US District Court for the District of Columbia, claiming that chair Khan’s personal experience during the breach created a conflict of interest.

The company further alleged that the FTC was improperly applying financial industry regulations to a hospitality business.

MGM prevails in earlier ruling

Before the FTC’s withdrawal, MGM had argued that the case should be transferred to the District of Columbia, where it had filed its own lawsuit challenging the Commission’s investigation.

In a December 2024 ruling, the US District Court for the District of Nevada denied the FTC’s motion to enforce the CID and granted MGM’s request to stay the case, pending resolution of the parallel lawsuit in Washington DC.

The court cited the first-to-file rule, noting that MGM’s constitutional claims regarding due process and regulatory overreach were already being litigated in the DC court.

However, the judge declined to transfer the case outright, stating that MGM had not sufficiently demonstrated that Washington DC was the appropriate venue under federal law.