Rivers Casino Data Breach: Negligence Claim Survives Dismissal Bid

A federal judge in Pennsylvania has ruled that the owners of Rivers Casino Philadelphia must face a proposed class action over a 2024 cyberattack. The August 7, 2026 decision lets a negligence claim move forward while dismissing almost every other theory in the complaint. Employees and patrons who sued Rivers Casino over the data breach will now press a single argument. They say the operator failed to take reasonable care with the personal information it held.

What the Court Allowed to Proceed

The negligence claim survived in the Eastern District of Pennsylvania because the plaintiffs tied the exposed records to real downstream harm. Courts often dismiss breach suits at this stage when the alleged injury looks speculative. Plaintiffs in the Rivers Casino case cleared that bar by linking the data breach to specific consequences they could describe.

The judge leaned on a 2018 Pennsylvania Supreme Court decision, Dittman v. UPMC, which established that an organization collecting and storing sensitive personal data owes a duty of reasonable care. That duty extends to foreseeable risks, including criminal intrusion. The court applied it directly to a gaming operator holding payroll records and patron identity documents.

Causation drew a fine but important line. The plaintiffs did not simply report vague suspicious activity after the fact. They alleged misuse of the same categories of information taken in the intrusion. That connection between failure and harm held up at the pleading stage.

Damages mattered just as much. Time spent monitoring accounts, changing passwords, placing fraud alerts and credit freezes, contacting banks, and paying for credit monitoring all counted as concrete injury. One plaintiff reported unrecognized charges on a bank card. Another described a surge in spam calls and emails after Rivers Casino sent its data breach notifications.

Which Claims the Court Threw Out

Rivers Casino defeated most of the remaining data breach claims outright. Negligence per se fell away because Pennsylvania does not recognize it as a standalone cause of action. The implied contract claim failed for a more instructive reason.

The complaint described an expectation of security rather than a mutual promise. The company's own privacy policy also disclaimed any guarantee that personal information would stay private or secure.

The court also dismissed claims for breach of fiduciary duty, breach of confidence, invasion of privacy, and unjust enrichment. Routine data collection does not create a fiduciary relationship. A third-party hack does not amount to a disclosure by the company. Paying for a service does not, on its own, support an unjust enrichment theory.

How the Rivers Casino Data Breach Unfolded

The data breach began with unauthorized access to Rivers Casino systems on two dates in October 2024. A review of the affected files closed on November 18 of that year. It identified who had been caught up in the incident. A second review, finished on February 16, 2025, pulled in more files and more people, including patrons of the company's Pittsburgh property.

Notification letters and emails went out starting December 30, 2024, roughly six weeks after the first review closed. The operator offered affected individuals one year of credit monitoring.

The exposed records included names, dates of birth, Social Security numbers, driver's license and passport details, and bank account information. Payroll banking details and government identifiers together give an attacker most of what identity fraud requires.

The Ransomware Claim Behind the Case

The complaint blames Cicada3301 for the data breach at Rivers Casino. The ransomware crew allegedly stole roughly 2.561 terabytes of files and published them on a dark web leak site. It set a ransom deadline of February 15, 2025. The operator acknowledged a security incident but never confirmed that claim, and no public disclosure has addressed a ransom payment or the initial point of entry.

Cicada3301 surfaced in June 2024 and runs as a ransomware-as-a-service operation, recruiting affiliates through underground forums. Its Rust-based encryptors target Windows, Linux, VMware ESXi, and network storage devices. Researchers have documented technical overlaps with the defunct ALPHV/BlackCat group, though nobody has conclusively proven a direct rebrand.

What Operators Should Take From the Ruling

Gambling venues sit on exactly the data attackers want. Loyalty programs capture identity documents, anti-money-laundering rules force operators to verify customers, and payroll systems hold bank details for staff. The same exposure applies to online casinos, which collect verification documents and payment credentials at signup.

The litigation against Rivers Casino over the data breach offers a practical map of legal risk. A negligence claim gains traction when plaintiffs can name the specific records exposed. It gains more when they show misuse of those same data types afterward. Documented response costs complete the chain.

Defenses built on the diffuse nature of modern fraud carry less weight once that chain is drawn. Arguing that phishing and card fraud hit everyone no longer settles the question.

Careful privacy language also earned its keep here. The disclaimer in the operator's privacy policy defeated the contract theory outright. Any business reviewing its own customer terms should note that result.

What Happens Next

The case now moves ahead on a single claim, and that claim carries discovery with it. Plaintiffs will push for answers about the security controls in place before October 2024. They will also probe how quickly the operator detected the intrusion.

Anyone notified by Rivers Casino about the data breach should keep credit freezes in place past the year of monitoring offered. Social Security numbers and passport details do not expire, and stolen records circulate for years. Watching for unfamiliar credit inquiries remains the most reliable early warning available.