Incident · State breach notice (California AG)
Rivers Casino Philadelphia data breach: files taken in October 2024, 1,942,182 people
Compiled from public records. Updated 2026-11-13. By the cisonews.net Desk.
The Rivers Casino Philadelphia data breach affected 1,942,182 people, according to the Oregon Department of Justice's breach list, which records a breach from October 14 to October 22, 2024 and notice on February 28, 2025. The casino says an unauthorized actor got into some of its computer systems and accessed or took files stored on its servers over nine days. The files held names with dates of birth, Social Security numbers, driver's license numbers or financial account numbers. The letter is signed by Sugarhouse HSP Gaming LP, which runs the casino, and offers one year of Experian IdentityWorks. The casino sent letters twice: Indiana's 2025 report records a first notice on December 30, 2024, counting 8,151 people, two months before the February letter.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.
What happened at Rivers Casino Philadelphia?
The casino says it responded to and investigated unauthorized access to some of its computer systems, secured them and opened an investigation. The investigation found an unauthorized actor had accessed or taken files on its servers between October 14 and October 22, 2024. The letter does not say when the casino first noticed the activity, or how the intruder got in.
| Date | What happened | Source |
|---|---|---|
| October 14 to 22, 2024 | Files accessed or taken from the casino's servers | Casino letter; Oregon list |
| December 30, 2024 | First letters; 8,151 people, 3 of them in Indiana | Indiana 2025 report |
| January 8, 2025 | NBC10 reports the casino is mailing letters; no count given | NBC10 Philadelphia |
| February 16, 2025 | Files with personal information identified | Casino letter; Oregon list |
| February 28, 2025 | Notice; report to Oregon (1,942,182) | Oregon list |
The notice came 129 days after the access ended and 12 days after the files were identified. The notice-delay guide compares that with other notices.
Why did Rivers Casino send two rounds of breach letters?
The records show two mailings for the same October 2024 access, and neither the casino's letter nor either state record explains the gap between them.
- December 30, 2024. Indiana's 2025 report lists a Rivers Casino Philadelphia notice sent that day, with a breach date of October 14, 2024, 3 Indiana residents and 8,151 people in total.
- February 28, 2025. The letter filed with California's attorney general is the one that names February 16, 2025 as the day files with personal information were identified. Oregon's list records this notice with 1,942,182 people.
In between, the casino confirmed the incident to NBC10 Philadelphia. In a statement the station published on January 8, 2025, a spokesperson said: "Rivers Casino Philadelphia is mailing letters to individuals whose information may have been involved in the incident." NBC10 reported that the casino had not said what information was involved, whether it belonged to customers, or how many people were affected.
If you got a letter dated around December 30, 2024, you were in the first, smaller group. A letter dated February 28, 2025 belongs to the larger mailing that followed the February 16 file review. Neither record says whether the 1,942,182 includes the first 8,151.
What information was exposed?
Name plus one or more of: date of birth, Social Security number, driver's license number and financial account number. The letter does not say whether the people affected are players, employees or both.
How many people were affected?
Two figures are on record, one per mailing:
| Notice | Record | People in total | In that state |
|---|---|---|---|
| December 30, 2024 | Indiana Attorney General, 2025 report | 8,151 | 3 |
| February 28, 2025 | Oregon Department of Justice list | 1,942,182 | Not given |
The larger figure, 1,942,182, is the one Oregon records for the February notice. The casino's own letter gives no count, and in January 2025 it had not given one to NBC10 either.
Washington's attorney general lists a notice from Rivers Casino Philadelphia reported on February 28, 2025, with 2,480 Washingtonians affected. Its record names names, Social Security numbers, driver's license or state ID numbers and passport numbers as the information compromised. The figure counts Washington residents only.
Who received the letters: players or employees?
The letter does not say. NBC10 framed the January 2025 report as the casino warning patrons, but quoted no casino statement on whose records were involved. The letter lists data types, not groups of people, so the record does not settle it.
What is Rivers Casino Philadelphia offering?
A one-year Experian IdentityWorks membership at no cost, which the letter says will not hurt your credit score. Questions about the incident go to 844-920-8866, Monday to Friday, 9:00 a.m. to 9:00 p.m. Eastern Time; Experian's line for the product is 833-918-4961. A credit freeze at each of the three bureaus is free and does not expire; the guide to credit monitoring offers explains the difference.
What the record leaves open
- How the unauthorized actor got in, and whether anything was encrypted.
- Whose records the files held: players, employees or both.
- Why it took until February 16, 2025 to identify the files, when letters had already gone out on December 30, 2024.
- Whether the 1,942,182 people in the February mailing include the 8,151 in the first.
How this disclosure's timing compares
Rivers Casino Philadelphia (Sugarhouse HSP Gaming LP) disclosed 12 days after the discovery date its notice gives. Across the 206 other state breach notices on cisonews.net that date discovery to the day, the median gap is 100 days.
California's breach-notice rule
California's breach law (Civil Code § 1798.82 for businesses, § 1798.29 for state agencies) requires any person or business that must notify more than 500 California residents of a single breach to submit one sample copy of that notice to the Attorney General electronically. The California Attorney General's breach list, where this notice was found, is built from those submissions. Source: California Department of Justice, Office of the Attorney General, Data Security Breach Reporting. The guide Data breach laws by state: notice deadlines and attorney general thresholds in 23 states reads the rule in full, and the glossary defines Breach notification law.
Other hospitality & entertainment incidents on cisonews.net
- Fandango Media, LLC, Breach notice, first disclosed November 13, 2026
- Kalahari Management Co. LLC, Breach notice, first disclosed November 9, 2026
- Center Theatre Group, Breach notice, first disclosed November 3, 2026
- Sarku Japan, Breach notice, first disclosed October 27, 2026; 6,424 affected in total (Indiana Attorney General)
- Magna Hospitality Group, Breach notice, first disclosed October 13, 2026; 25,623 affected in total (Indiana Attorney General)
Sources
- 2026-11-13 · AWashington State Office of the Attorney General, data breach notifications list, published November 13, 2026
- 2025-02-28 · ASugarhouse HSP Gaming LP (Rivers Casino Philadelphia), notice filed with the California Attorney General, published February 28, 2025
- 2026-11-11 · AOregon Department of Justice, consumer data breach list, published November 11, 2026
- 2026-11-12 · AIndiana Attorney General, 2025 data breach year-to-date report, published November 12, 2026
- 2025-01-08 · BNBC10 Philadelphia, Rivers Casino Philadelphia reaching out to those impacted after data breach, published January 8, 2025
- undated · ACalifornia Department of Justice, Office of the Attorney General, Data Security Breach Reporting
Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.