FTC Petition Seeks to Compel Documents for Its Probe Into MGM’s Data Breaches

The FTC seeks an order enforcing a Jan. 25 civil investigative demand (CID) issued to MGM Resorts International for documents and information relevant to the commission’s ongoing investigation into MGM’s data security practices, said the agency’s petition Monday (docket 2:24-cv-01112) in U.S. District Court for Nevada in Las Vegas. MGM “has refused to comply” with the CID, said the petition. Judicial enforcement is necessary so that FTC staff “may thoroughly and expeditiously conduct its investigation,” it said. The FTC “has met all of the requirements for judicial enforcement of the CID,” it said. It therefore asks the court to issue an order requiring MGM to appear and show cause why it shouldn’t comply with the CID, it said. The court thereafter should grant the FTC’s petition and enter an order compelling MGM to produce the documents and information specified in the CID, it said. Since 2019, MGM has experienced at least three publicly reported data breaches implicating consumers’ personal information, the most recent in September (see 2404020004), said the petition. After the latest breach, the FTC launched an investigation into MGM’s acts and practices relating to the privacy and data security of its consumers, it said. MGM’s failure to comply with the CID has “materially impeded” the commission’s ongoing investigation, it said.