11 Aug 2026
Federal Court Allows Negligence Claims to Advance in Rivers Casino Philadelphia Data Breach Lawsuit
A federal judge in the US District Court for the Eastern District of Pennsylvania has determined that a class-action negligence lawsuit against Rivers Casino Philadelphia can move forward after a November 2024 cyberattack exposed more than 2.56 terabytes of employee data on the dark web, while other claims were dismissed at this stage.
The ruling centers on allegations that the casino failed to adequately protect sensitive information belonging to employees, which included Social Security numbers, driver’s licenses, and banking details; plaintiffs claim this exposure led to instances of identity theft and increased spam, whereas the casino maintained that such incidents occur widely across industries and bear no direct connection to the breach itself.
Details of the November 2024 Incident and Resulting Claims
The cyberattack at Rivers Casino Philadelphia, operated by Rush Street Gaming, resulted in a substantial volume of personal employee records appearing on dark web forums, prompting the class-action filing that sought remedies under multiple legal theories; court records indicate the judge reviewed evidence of the data exposure and found enough basis to permit the negligence portion of the suit to continue toward discovery and potential trial.
Plaintiffs asserted that the casino’s security practices fell short of reasonable standards, allowing unauthorized access that placed their financial and personal identifiers at risk, and they pointed to subsequent problems with identity misuse and unsolicited contacts as direct outcomes; the defense countered by noting that similar data leaks happen frequently in various sectors and that no causal link had been established between the casino’s systems and the reported issues.
Court’s Specific Findings on Negligence Versus Dismissed Counts
Judicial analysis concluded that the negligence claim met the threshold for proceeding because plaintiffs presented plausible arguments regarding duty of care and resulting harm, yet the court dismissed breach of contract allegations on grounds that no enforceable contractual obligation was sufficiently demonstrated in the filings, and invasion of privacy claims were set aside for lack of particularized evidence tying the casino’s actions directly to privacy violations under applicable precedents.
This selective allowance means the case now focuses primarily on whether Rivers Casino Philadelphia maintained adequate safeguards around employee data repositories, with both sides preparing for further proceedings that could include depositions and examination of security protocols in place before the November 2024 event.
As the litigation advances into August 2026, attorneys for the class have begun coordinating with data security experts to assess the scope of exposure, while Rush Street Gaming continues to assert that industry-wide threats make isolated attribution difficult; observers note that the Eastern District’s decision aligns with patterns seen in other corporate data incidents where negligence survives initial motions but contract-based theories require stronger documentation.
Background on Parties and Legal Context
Rush Street Gaming, the parent company of Rivers Casino Philadelphia, has maintained operations in the region with standard compliance frameworks for handling patron and staff information, yet the November 2024 breach highlighted vulnerabilities that plaintiffs argue warranted stronger preventive measures; the casino’s response emphasized its cooperation with law enforcement and notification processes following discovery of the data on illicit sites.
The Eastern District of Pennsylvania has handled numerous data-related matters in recent years, applying standards that require plaintiffs to show both a duty and concrete injury, which in this instance supported continuation of the negligence track but halted the remaining counts; legal teams on both sides have referenced prior rulings from the circuit that shape how such cybersecurity disputes evolve through the courts.
Next Steps in the Class-Action Process
With the negligence claim cleared for further development, the parties will engage in discovery phases that examine internal security audits, third-party vendor access logs, and any prior warnings about system weaknesses at the Philadelphia property; plaintiffs intend to present evidence linking specific instances of identity theft to the exposed records, while the casino plans to introduce comparative data on breach frequency across hospitality and gaming sectors.
Court scheduling orders issued after the ruling set timelines for motions and potential settlement discussions, although no resolution date has been confirmed; participants in the class action continue to monitor credit monitoring services and report ongoing effects from the data appearing publicly in late 2024.
Conclusion
The decision by the US District Court for the Eastern District of Pennsylvania marks a key juncture in the Rivers Casino Philadelphia data exposure litigation, allowing the negligence component to advance while trimming other elements from the complaint, and the case remains active as of August 2026 with both sides preparing for expanded evidentiary review. According to Eastern District of Pennsylvania court records, procedural milestones now guide the remaining claims toward resolution. Industry monitoring groups such as the American Gaming Association have tracked similar matters nationwide, providing context on how operators respond to comparable incidents without influencing the specific outcome here.