Share 
Station Casinos and its parent company, Red Rock Resorts Inc., are facing a class-action lawsuit following the disclosure of a data breach stemming from a March 2026 cyberattack.
Clark County resident Susan Geiner filed the lawsuit individually and on behalf of others similarly situated in the US District Court in Nevada, accusing the operator of failing to implement adequate cybersecurity safeguards and exposing customers and employees to identity theft.
The scope of the Station Casinos data breach
The lawsuit states the data breach occurred March 5. Station Casinos disclosed the breach May 21 in a filing with the Maine Attorney General’s Office. The company confirmed that the breach compromised personally identifiable information (PII) belonging to employees and customers.
The stolen information may include names, email addresses, physical addresses, phone numbers, dates of birth, driver’s license numbers, passport numbers, vehicle details, and credit card information.
According to Station Casinos, an outside hacker gained access to the company’s systems by compromising a single employee’s account, which was connected to company files.
Unlike the high-profile 2023 attacks on MGM Resorts International and Caesars Entertainment — which disrupted hotel keys, reservation systems, and slot machines — Station Casinos reported that its operations continued without interruption.
Lax cybersecurity measures and delayed notification
The lawsuit was filed by the Las Vegas-based Freedom Law Firm and Ahdoot & Wolfson of King of Prussia, Pennsylvania, and argues that Station Casinos should have recognized the appeal of its customer data to cybercriminals and implemented stronger safeguards.
The filing alleges that the company’s internal security systems were wholly inadequate.
“The fact that the hackers could perform these overt, noisy operations without detection strongly suggests that defendants failed to implement and maintain the necessary monitoring and alerting systems, including endpoint detection and response tools, sufficient to timely identify malicious activity,” the filing states.
The lawsuit also faults Station Casinos for its delayed notification to affected individuals. The company discovered the breach on March 5, 2026, but did not notify affected consumers until May 21, 2026 — a gap of more than 11 weeks. The plaintiffs argue the delay left victims unaware and unable to take timely protective action.
Plaintiffs seek damages, credit monitoring, and more
The lawsuit seeks a jury trial and asks for actual damages, statutory damages, equitable relief, restitution, disgorgement, and statutory costs. According to a report by the Las Vegas Review-Journal, it also seeks an order requiring Station Casinos to pay the costs involved in notifying potential class members and administering the claims process, as well as prejudgment and post-judgment interest and reasonable attorneys’ fees.
Station Casinos confirmed the breach to cybersecurity outlet Cybernews the day after customer notifications were sent, and is offering free credit monitoring and identity theft protection to impacted customers. The company also reported that it cooperated with law enforcement and the Nevada Gaming Control Board and brought in cybersecurity experts. It has not confirmed whether a ransom was demanded or paid.
A troubling pattern: Nevada casinos keep getting hacked
Station Casinos is now the fifth major Nevada casino operator to be hit by a significant cyberattack since 2023. MGM Resorts International and Caesars Entertainment were both struck in September 2023, linked to the Scattered Spider and ALPHV/BlackCat hacking groups.
Boyd Gaming suffered a breach in 2025 involving employee data theft. Wynn Resorts was hit in October 2025, with the ShinyHunters group claiming to have exfiltrated 800,000 records before Wynn confirmed the incident.
The MGM Resorts cyberattack ended in a $45 million class-action settlement, setting a notable precedent for what Station Casinos may now face. The company had anticipated the incident would cause roughly $100 million in losses, though insurance coverage helped offset much of that financial impact.
