Judge Allows Data Breach Lawsuit Against Rivers Casino Philadelphia to Proceed

Rivers Casino Philadelphia isn’t off the hook for a data breach that exposed private information — in fact, it’s far from it.

Judge Joshua D. Wolson of the U.S. District Court for the Eastern District of Pennsylvania ruled last Friday that the plaintiffs in the case had presented enough evidence to support a claim of negligence against Sugarhouse HSP Gaming LP and Rush Street Gaming LLC, the owners and operators of the casino.

The breach was discovered in November 2024. Rivers Casino did not notify individuals whose information was released until near the end of the year.

Rivers Casino Philadelphia sued for cyberattack

The plaintiffs in the case asserted that Rivers Casino did not fulfill its obligations under common law, contract law, industry expectations, and the Federal Trade Commission Act. Those claims stemmed from the gaming giant’s failure to implement and maintain the proper safety protocols. 

Rush Street asked Judge Wolson to dismiss the class-action lawsuit. However, the decision confirmed that the aggrieved parties had enough merit to their case for it to progress.

Notably, the judge’s decision does not assign blame or civil or criminal wrongdoing to Rush Street or Sugarhouse.

The breach occurred when an unauthorized source accessed and withdrew files stored on the casino’s servers. Rivers Casino did not send out a notice to company employees until six weeks later, allowing the compromised information to remain exposed without additional security measures. 

Rivers eventually filed a notice with the Massachusetts Attorney General’s office.

Exposed information included names, social security numbers, driver’s license numbers, passport details, and bank account information of current and former employees and customers. Rivers still hasn’t confirmed the number of individuals whose personal data was breached.

Merits and disagreements

Rivers publicly acknowledged the attack for the first time in Jan. 2025. It initially believed that only the information of company employees was compromised.

“We regret any inconvenience or concern this incident may cause you. Rivers Casino Philadelphia recognizes the importance of protecting the personal information we maintain,” a letter from the casino to employees read.

The casino offered its workers one year of free credit monitoring to account for the mistake.

Hackers allegedly stole more than 2.56 terabytes of data — the equivalent of about 17 million PDF pages —though that still isn’t much compared to Rivers’ entire customer database. The retrieved information was subsequently sold for cash on the dark web.

Attorneys for Rivers claimed that phishing emails, suspicious logins, and fraudulent credit card charges were common occurrences and could not be directly tied to the data breach. Wolson denied that claim, saying that a direct link could be proved.

Wolson did side with Rivers and dismissed accusations of breaching industry standards, creating an invasion of privacy, and unjust enrichment. Rivers can now respond before a new court date is scheduled.

Rivers Casino Philadelphia is still open to this day. It operates blackjack, craps, live-dealer table games, slot machines, and more common casino amenities.