A Clark County woman has filed a class-action lawsuit in U.S. District Court in Nevada against locals casino giant Station Casinos following the company’s disclosure of being a victim of a March cybersecurity attack.
Susan Geiner filed the lawsuit individually and on behalf of others similarly situated on Thursday, shortly after the incident was first made public.
The lawsuit names Red Rock Resorts Inc., the parent company of subsidiaries Station Holdco LLC and Station Casinos LLC, as defendants.
Station representatives acknowledged the data breach in a Monday emailed statement.
The company also sent notifications to loyal customers about the breach and has offered to provide credit monitoring services and identity theft protection to individual customers at no cost.
Geiner’s lawsuit, filed as a potential class action by the Las Vegas-based Freedom Law Firm and Ahdoot & Wolfson in King of Prussia, Pennsylvania, says Station Casinos should have known it was a potential target of cybercriminals and should have done more to protect its data from hackers.
“The hospitality and gaming industries are a prime target for ransomware attacks such as this because these organizations store vast amounts of sensitive data, including (Social Security numbers), financial information, and personal identification details,” the lawsuit says. “This data is incredibly valuable on the black market, where it can be sold for purposes such as identity theft and fraud. The high demand for this data makes hotels and casinos a lucrative target for cybercriminals.”
The lawsuit also says the company’s computer system should have been better protected.
“The fact that the hackers could perform these overt, noisy operations without detection strongly suggests that defendants failed to implement and maintain the necessary monitoring and alerting systems, including endpoint detection and response tools, sufficient to timely identify malicious activity and empower defendants cybersecurity staff to stop or limit the attack,” the lawsuit says.
The lawsuit seeks a jury trial, adding the plaintiff seeks “appropriate monetary relief, including actual damages, statutory damages, equitable relief, restitution, disgorgement and statutory costs.”
It also seeks an order requiring Station to pay the costs involved in notifying potential class members about the judgment and administering the claims process.
The lawsuit also seeks prejudgment and post-judgment interest, reasonable attorneys’ fees, costs and expenses and “further relief as this court may deem just and proper.”
Station, which also has notified regulators of the cyberattack, has said it would make no other comments beyond the statement it issued earlier in the week.
Station is the fifth major casino company in Nevada to become a victim of a cyberattack in nearly three years.
Before the Station attack in March, Wynn Resorts Ltd. properties were attacked in October, but disclosed it in February; fellow locals casino operator Boyd Gaming Corp. was attacked in September; MGM Resorts International was attacked in September 2023; and Caesars Entertainment Inc. was hit in August 2023.
In the MGM case, the company settled two class-action lawsuits for $45 million in the wake of the attack and insurance policies paid for the estimated $100 million in damages to the company.
Contact Richard N. Velotta at rvelotta@reviewjournal.com or 702-477-3893. Follow @RickVelotta on X.
