Review: Rivers Casino ruling puts operator data security duties in the spotlight

Focus Gaming News reports that a federal judge has allowed a negligence claim to proceed in the class action against Rivers Casino Philadelphia over the January cyberattack. The ruling from Judge Joshua D. Wolson keeps the case alive even as breach of contract, unjust enrichment, invasion of privacy and breach of confidence claims were dismissed.

The piece grounds the decision in the plaintiffs' allegation that names, Social Security numbers and bank account details may have been exposed, and notes the court treated post-breach reports of attempted fraud as supporting the plausibility of the negligence claim. It also flags that customers were notified but argue "the full scope of the attack was not revealed."

This is the part of the ruling that matters beyond Philadelphia. A court accepting that a casino owes customers a duty of reasonable care over personal data, and that attempted fraud after a breach makes a negligence claim plausible, raises the bar for every operator holding player and payment data. Class actions that survive a motion to dismiss create pressure to settle, and they push data protection from an IT concern to a board-level liability issue.

At the same time, the dismissal of most other claims is a reminder that not every theory survives. Operators face a narrower but real exposure around negligence, and the practical question going forward is what discovery reveals about the actual scope of the breach and the casino's security posture.

For anyone tracking cyber risk in gaming, the original piece is worth reading for the legal detail and next steps in the case.