Station Casinos Faces Class Action Lawsuit Over March 2026 Cyberattack That Exposed Customer Data

Station Casinos, the Las Vegas-based regional casino company that operates more than a dozen properties in the Nevada market, is facing a class action lawsuit filed in the wake of a cyberattack that occurred in March 2026 and exposed customer personal and financial data. The suit, filed on behalf of affected customers, alleges that Station Casinos failed to implement adequate cybersecurity protections and was negligent in safeguarding the personal information it collected from patrons.

The March 2026 breach affected Station Casinos’ systems and exposed data from customers who had used the company’s loyalty programs and digital services. Station Casinos operates a portfolio of properties in the Las Vegas area including Red Rock Resort, Green Valley Ranch, Palms Casino Resort, and Santa Fe Station, among others. The company’s Boarding Pass loyalty program, which tracks player activity across its properties, was among the systems reported to have been affected by the incident.

What the Lawsuit Claims

The class action complaint alleges that Station Casinos knew or should have known the risks of a cyberattack given the gaming industry’s history of high-profile breaches and that it failed to deploy adequate security measures to protect its customers’ data. Plaintiffs are seeking damages for the harm caused by the exposure of personal information, as well as injunctive relief requiring Station Casinos to improve its cybersecurity practices going forward.

Data exposed in breaches of this type typically includes names, contact information, dates of birth, loyalty account details, and in some cases payment card or financial information. The specific categories of data compromised in the Station Casinos breach were not fully disclosed by the company in its initial public communications about the incident, which the lawsuit also cites as a failure to provide timely and adequate notification to affected customers.

Station Casinos is not the first major gaming company to face this type of litigation. MGM Resorts International and Caesars Entertainment both faced class action lawsuits following separate cyberattacks in 2023, with Caesars settling one of the early cases for a reported $15 million. The MGM breach, which was more extensive and resulted in prolonged systems outages across multiple properties, generated multiple consolidated class actions that remained active into 2025.

Gaming Industry Cybersecurity Under Scrutiny

The Station Casinos breach adds to a pattern of major cyberattacks targeting casino and gaming companies that has persisted since at least 2023. The gaming sector is considered a high-value target for ransomware and data theft operations because of the large volumes of personally identifiable information and financial data that casinos collect through loyalty programs and digital payment systems. Nevada gaming regulators have increasingly emphasized cybersecurity preparedness as a licensing and compliance issue in the wake of the 2023 breaches.

The class action lawsuit against Station Casinos is in its early stages, and the company has not yet formally responded in court to the complaint. Station Casinos operates within the larger parent company structure of Station Casinos LLC, which is controlled by the Fertitta family. The Fertittas’ gaming empire took on additional significance in 2026 when Fertitta Entertainment announced a $17.6 billion deal to acquire Caesars Entertainment, a transaction that, if completed, would create one of the largest casino operators in the United States.