Share 
A federal judge ruled Aug. 7 that a proposed class-action lawsuit against Rivers Casino Philadelphia can proceed, finding that the plaintiffs’ negligence claim warrants further review. The case stems from a 2024 cyberattack that allegedly exposed sensitive personal information belonging to employees and patrons.
US District Judge Joshua D. Wolson of the Eastern District of Pennsylvania found that the plaintiffs had adequately pleaded a claim of negligence against Sugarhouse HSP Gaming LP and Rush Street Gaming LLC, the entities that own and operate Rivers Casino Philadelphia, according to Bloomberg Law.
The plaintiffs allege the companies breached duties owed under common law, contract law, industry standards and the Federal Trade Commission Act by failing to implement reasonable data-security measures.
While the court dismissed several other claims, the ruling clears the way for the negligence dispute to enter the next phase of litigation. The case also reflects growing legal scrutiny of cybersecurity practices across the gaming industry, where operators routinely handle large volumes of employee and customer data, including sensitive financial and identity records.
Judge says casino may have skipped reasonable safeguards
The lawsuit stems from a cyberattack discovered in November 2024 and disclosed by Rivers Casino Philadelphia in January 2025. According to court filings, the breach involved the theft of sensitive data that was later offered for sale on the dark web.
Rush Street Gaming, the Chicago-based parent company of Rivers Casino Philadelphia, and its BetRivers Online Casino platform, had asked the court to dismiss the proposed class action before it advanced. Wolson wrote that the plaintiffs had “plausibly alleged” that Rivers failed to use reasonable care in safeguarding their personal information, allowing the negligence claim to survive even as he dismissed several other arguments in the complaint.
The court rejected claims of breach of contract, breach of confidence, invasion of privacy and unjust enrichment. Those dismissals narrow the scope of the case but do not end the lawsuit.
Empolyees, patrons both affected despite initial claims
Rivers Casino Philadelphia first notified employees about the breach in January 2025, saying it believed the compromised information involved workers, and offered affected employees one year of complimentary credit monitoring.
The company said it regretted any concern the incident caused and emphasized the importance of protecting the personal information it maintains. The lawsuit, however, alleges the breach also affected casino patrons.
According to the complaint, hackers obtained more than 2.56 terabytes of data before posting the stolen files for sale online. The information allegedly included Social Security numbers, driver’s license details, passport information and banking records.
While that volume represents only a fraction of what many businesses store, cybersecurity experts note that even relatively small data sets can contain records sensitive enough to facilitate identity theft and financial fraud.
Casino disputes link between breach and reported fraud
Several plaintiffs claim they experienced suspicious activity after the cyberattack. Mark Metzler alleged that unauthorized charges appeared on his Wells Fargo credit card, and Shawn Martin said he noticed a sharp increase in spam calls, emails and texts.
The complaint also cites phishing attempts, fraudulent account activity and credit-related inquiries the plaintiffs believe are connected to the breach — allegations that have become increasingly common in data breach litigation.
Attorneys for Rivers Casino Philadelphia argued that the reported fraud could have stemmed from any number of unrelated events, noting that phishing emails, spam and fraudulent charges are widespread and cannot automatically be tied to a single incident.
Wolson declined to accept that argument at this early stage, finding the plaintiffs’ allegations sufficient to reasonably infer a connection between the breach and the reported misuse of their information. Whether that link can be proved will be determined later in the litigation.
This is one of several suits filed in the Eastern District of Pennsylvania since the breach was disclosed, according to a related Law360 report on the case’s early filings. The ruling does not establish liability or find Rivers responsible for the alleged damages; it means the negligence claim has cleared the initial hurdle required for the case to continue.
Rivers Casino must now respond to remaining claim
With the motion to dismiss resolved, Rivers Casino Philadelphia must now formally respond to the remaining negligence claim before the court sets a litigation schedule.
The case illustrates how cyberattacks continue to affect businesses across industries, including gaming and hospitality. Real-money online casinos and their retail counterparts collect extensive personal and financial information to support employment records, loyalty programs, payment processing and regulatory compliance, making them attractive targets for cybercriminals.
For casino operators, the outcome could offer another data point on how US courts evaluate data-security claims after a breach. Although the court dismissed several legal theories, it allowed the negligence claim to proceed — suggesting such claims may survive when plaintiffs present sufficient factual allegations linking inadequate cybersecurity safeguards to the exposure of sensitive personal information.
