A federal judge has refused to dismiss a proposed class action against the owners of Rivers Casino Philadelphia over a 2024 data breach.
Judge Joshua D. Wolson of the U.S. District Court for the Eastern District of Pennsylvania ruled on August 7 that the plaintiffs had adequately pleaded a negligence claim against Sugarhouse HSP Gaming LP and Rush Street Gaming LLC, which own the casino and run it. The case now moves into discovery, where the scale of the breach and the operator's data practices can be tested.
The breach was found around November 18, 2024. Plaintiffs say unauthorized access to servers came with the exfiltration of files. Notices to affected people began around December 30, 2024, roughly six weeks later. The Massachusetts attorney general's office was also notified. Names, Social Security numbers and direct-deposit bank details were compromised. Current and former employees and customers are affected.
What the plaintiffs want
They claim the companies failed to protect sensitive information and breached duties under common law, contract terms, industry practice and the Federal Trade Commission Act. It is at least the third suit in the Eastern District of Pennsylvania since the breach was disclosed. A Radnor firm filed earlier on behalf of a Philadelphia resident, seeking class status and damages. Levi & Korsinsky and Edelson Lechtzin ran separate investigations for potential victims. The plaintiffs also argue the delay in notification cut the window people had to guard against identity theft and fraud.
For operators, the six weeks between discovery and the first letters is now a courtroom argument. Notification timelines deserve a second look.
