Riverside Resort & Casino Settles Data Breach Lawsuit for $1.5M

A massive data breach has resulted in significant legal consequences for the Riverside Resort & Casino in Laughlin, Nevada. The gambling company has agreed to a settlement of at least $1.5 million to resolve a class action lawsuit. The case stems from a targeted cyberattack in July 2024, where hackers gained access to highly sensitive information belonging to more than 51,000 individuals. In today's digital world, where data is considered the new gold, this incident once again demonstrates how vulnerable even established casino operators can be if IT security is not up to date.

Plaintiffs accused the operator of failing to implement adequate protective measures to ensure customer privacy. The stolen data included not just simple address information, but also Social Security numbers, driver's license numbers, and detailed financial information. While Riverside Resort & Casino Inc. and Riverside Resort & Casino LLC deny any wrongdoing, they chose to settle to avoid the unpredictable risks and costs of continued litigation. For those affected, this provides at least some financial solace, even if trust in data security may be permanently damaged.

Numbers and facts

The settlement stipulates that class members can receive up to $3,000 for documented out-of-pocket expenses directly resulting from the data theft. This includes losses from identity theft, credit report fees, or costs for replacing identification documents. Those who cannot provide concrete proof will not go empty-handed; they are eligible for a flat fee of $50, while residents of California can receive $75 due to the state's stricter privacy regulations.

Additionally, affected individuals can claim up to three hours of lost time spent researching the breach or changing passwords. This time is compensated at a rate of $20 per hour, totaling a maximum of $60. It is important to note that these amounts are included within the $3,000 cap. Attorney fees in this case are capped at half a million dollars. Overall, a fund of $1 million is available for cash payments. If approved claims exceed this amount, payments will be reduced proportionally (pro rata).

Background

Riverside Resort & Casino is an institution in Laughlin, a city often overshadowed by Las Vegas but one that generates significant revenue in the gambling sector. The incident in July 2024 was not an isolated case in the industry. In recent years, casinos have increasingly become targets for ransomware attacks and data theft because they store vast amounts of personal and financial data. The current settlement is a clear signal to the industry that negligence in cybersecurity can be expensive.

Affected parties now have until January 4, 2027, to officially file their claims. While the casino attempts to legally close this chapter, the threat landscape for the industry as a whole remains high. Interestingly, recent data from the Nevada Gaming Control Board shows that gaming revenue in the state remained flat for September, increasing the pressure on operators to control costs while simultaneously investing in security.

Why it matters for German players

For German players active in online casinos, this case emphasizes the enormous importance of regulation. Those who play at providers without a license from the Gemeinsame Glücksspielbehörde der Länder (GGL) expose themselves to considerable risk. In the event of a data breach at a provider from Curacao or other offshore zones, German customers have little legal leverage to seek compensation like in the Riverside case. The German State Treaty on Gambling 2021 (GlüStV 2021) sets strict rules for data protection and IT security.

Through the central LUGAS system and connection to the OASIS exclusion file, it is ensured that data is processed only for specific purposes and under strict security requirements. German licenses guarantee that the IT infrastructure of providers is regularly audited. While there is a deposit limit of 1,000 euros per month and a stake limit of 1 euro per spin, these measures serve not only player protection but also transparency and security. A data breach like the one in Nevada would be a serious violation for a GGL-licensed provider, potentially leading to immediate license revocation.

What it means for GGL-licensed casinos

The GGL whitelist is the only safe haven for German users. Casinos with this license must prove they are protected against cyberattacks. Should an incident occur, German law provides much more stable grounds for compensation claims than international gray markets. German players should therefore be meticulous about playing exclusively at providers with the GGL seal to protect their sensitive banking and personal information as best as possible.

"The casino agreed to settle the lawsuit to avoid the risks and costs of continued litigation." - Riverside Resort & Casino Management, Statement on the settlement