Riverside Resort and Casino Data Breach Settlement $1.5 Million Claim for Privacy Theft

In July 2024, Riverside Resort and Casino reported a targeted cyberattack that affected 51,646 people, including current and former employees and other individuals who received a notice saying their private information may have been compromised. The data described in the notice includes highly sensitive items such as names, addresses, Social Security numbers, driver’s license and government ID numbers, financial account information, medical or health insurance details, and dates of birth—data that can be used for identity theft, fraudulent financial activity, and other harms. In response, the company agreed to a class action settlement after allegations claimed it did not do enough to protect that information, even though Riverside denies the underlying wrongdoing. The lawsuit was filed to hold Riverside accountable for privacy and security failures and to compensate people who may have spent money or time dealing with the fallout. The settlement provides multiple benefit options: up to $3,000 for documented out-of-pocket losses (like identity theft-related expenses and credit monitoring costs), up to three hours at $20 per hour for time spent responding (within the same overall cap), and an alternative cash payment estimate (about $75 for California residents and $50 for others) if no other loss/time claim is submitted. All class members can also request one year of credit and identity monitoring through CyEx Financial Shield Total, with a shared payment cap of $1 million; if claims exceed the cap, payouts are reduced proportionally (a pro rata reduction), reflecting how common these mechanisms are in data-breach settlements. Broader implications extend beyond one company: privacy-and-cyber cases like this have become increasingly frequent as organizations face pressure to implement stronger safeguards. In the U.S., incidents involving personal data often trigger state breach-notification laws and require companies to follow industry expectations for “reasonable security,” and larger settlements sometimes reference obligations under regimes such as the Federal Trade Commission’s authority over unfair or deceptive practices, as well as sector-specific standards like the Payment Card Industry (PCI) framework when payment data is involved. Settlements also commonly include attorney fees, service awards, and a structured claims process to manage proof and payment logistics, underscoring that even when a company denies wrongdoing, these cases can still reshape risk practices and compliance priorities across the hospitality and broader tech-dependent industries.