Pennsylvania Federal Judge Clears Path for Class-Action Negligence Claims in Rivers Casino Data Exposure Case

A federal judge in the US District Court for the Eastern District of Pennsylvania has ruled that negligence claims in a class-action lawsuit against Rivers Casino Philadelphia can move forward, while several other allegations have been set aside, according to court documents filed in the matter involving a 2024 cyberattack that compromised extensive employee records.

The decision centers on events from November 2024 when unauthorized parties accessed and later distributed more than 2.56 terabytes of personal information belonging to casino employees, and the ruling comes as the case advances through the judicial system in the summer of 2026.

Details of the Cyberattack and Initial Response

Rush Street Gaming owns Rivers Casino Philadelphia, and the breach exposed Social Security numbers along with driver's licenses, passports, and banking details that subsequently appeared on dark web forums, while the company notified affected employees in January 2025 and provided credit monitoring services as an initial step to address the incident.

Those notifications outlined the scope of the exposed data and the steps the casino had taken after discovering the intrusion, and plaintiffs in the lawsuit contend that the incident led to instances of identity fraud and increased spam targeting individuals whose information was compromised.

Scope of the Lawsuit and Court Ruling

The class-action complaint alleges negligence on the part of the casino in safeguarding sensitive employee information, and the federal judge determined that this particular claim meets the threshold to proceed to further stages of litigation, whereas allegations related to breach of contract were dismissed during the same review.

Court records indicate that the negligence portion focuses on whether adequate security measures were in place prior to the attack, and observers note that such rulings often hinge on specific facts about data protection protocols rather than broad industry standards alone.

Plaintiffs argue that the casino failed to implement sufficient safeguards against unauthorized access, and the judge's order allows discovery and related proceedings to continue on those grounds while limiting the case to the remaining viable claims.

Employee Impact and Subsequent Developments

Affected workers have reported various issues following the data posting, including attempts at fraudulent account openings and unsolicited communications, and the lawsuit seeks to represent a class of individuals whose personal details were part of the 2.56 terabytes released online.

Legal proceedings in the Eastern District of Pennsylvania have moved steadily since the initial filing, and updates as of August 2026 show that the negligence claims remain active as both sides prepare for additional phases of the case.

The casino has maintained that it responded promptly once the breach was identified, and company statements emphasize the credit monitoring offer extended to employees shortly after the January 2025 notifications.

Legal Context and Case Trajectory

Federal courts handling similar data exposure matters often evaluate whether organizations met reasonable standards for protecting personally identifiable information, and this ruling aligns with patterns seen in other negligence-focused actions where contract claims do not survive initial motions.

Attorneys for the plaintiffs have indicated plans to pursue evidence related to the casino's cybersecurity practices leading up to the November 2024 incident, while defense counsel continues to contest the scope of potential liability under the surviving claims.

Public records from the district court show no immediate appeals filed following the judge's decision, and the case now enters a period where additional motions and fact-finding can occur within the established parameters.

Conclusion

The ruling by the US District Court for the Eastern District of Pennsylvania permits the negligence elements of the class-action suit to advance against Rivers Casino Philadelphia in connection with the 2024 employee data breach, and it leaves the matter positioned for further development as of mid-2026 while contract-based allegations have been removed from consideration.