Rivers Casino Philadelphia Loses Bid to Toss Data Breach Class Action Suit
A federal judge ruled Rivers Casino Philadelphia must face a proposed class action alleging it failed to protect customer and employee data exposed in a 2024 breach.
Rivers Casino Philadelphia will have to keep fighting a proposed class action lawsuit after a federal judge ruled the case can move forward, rejecting the casino operator’s bid to have the suit dismissed. The lawsuit stems from a 2024 data breach that exposed the personal information of thousands of customers and employees.
Judge Joshua D. Wolson of the U.S. District Court for the Eastern District of Pennsylvania ruled on Aug. 7 that the plaintiffs adequately pleaded a claim of negligence against Sugarhouse HSP Gaming LP and Rush Street Gaming LLC, the entities that own and operate Rivers Casino Philadelphia. The plaintiffs allege the companies breached their duties under common law, contract law, industry standards, and the Federal Trade Commission Act by failing to implement reasonable and adequate data-security measures.
How the Breach Unfolded
The breach was first discovered around Nov. 18, 2024, when an unauthorized actor accessed and allegedly exfiltrated files stored on the casino’s computer servers. Rivers Casino Philadelphia did not begin notifying affected individuals until roughly six weeks later, sending out letters and emails around Dec. 30, 2024. The casino also filed a notice with the Massachusetts Attorney General’s office detailing the incident.
According to court filings, the compromised data included names, Social Security numbers, and bank account information used for direct deposit. Both current and former employees and customers were reportedly affected. The casino has not disclosed the exact number of people impacted, though the scope of the exposed records has drawn scrutiny given the sensitivity of the financial and identifying information involved.
Multiple Suits, Same Core Allegations
The case decided by Judge Wolson is one of at least three lawsuits filed in the Eastern District of Pennsylvania in the weeks following the breach disclosure. One of the earliest was filed by a Radnor-based law firm on behalf of a Philadelphia resident, seeking class-action status along with compensatory damages and other relief. Law firms including Levi & Korsinsky and Edelson Lechtzin have separately investigated the breach on behalf of potentially affected individuals.
The plaintiffs argue that Rivers Casino’s delayed notification — more than a month after the breach was first detected — compounded the harm by giving victims less time to protect themselves from identity theft and fraud. With the motion to dismiss now denied, the case will proceed toward discovery, where more details about the scope of the breach and the casino’s security practices are likely to emerge.
Data breach litigation against gaming and hospitality companies has become increasingly common as casinos collect growing volumes of sensitive customer data through loyalty programs, direct deposit payouts, and online account systems. Rivers Casino Philadelphia’s case is now positioned as a test of how much responsibility operators bear when that data is compromised — a question with implications well beyond one Pennsylvania casino floor for anyone weighing where to play at the Pennsylvania sportsbooks and casinos operating in the state.