Rivers Casino Philadelphia notifies employees of data breach

Posted: 7 January 2025, 03:29 pm.

Last updated: 7 January 2025, 03:29 PM.

Rivers Casino Philadelphia has acknowledged that its computer systems storing sensitive information about employees were compromised last fall.

In a letter to employees, the casino owned and operated by Rush Street Gaming confirmed a “data security incident” that may have compromised personal information. The letter said staff members' Social Security numbers and banking account information used for direct deposits were likely seized by a bad actor.

“We regret any inconvenience or concern this incident may have caused you,” the letter said. “Reverse Casino Philadelphia recognizes the importance of protecting the personal information we hold.”

Rush officials said there were no impacts to any other Rivers casinos. River Philly is offering its affected employees a one-year subscription to credit monitoring services. The company says it has taken additional security measures to better protect and safeguard its IT networks.

River Casino Philadelphia, formerly the Sugar House, is located along the Delaware River northeast of the downtown area. The casino features over 1,500 slot machines, 70 live dealer table games, and a BetReverse sportsbook. The casino recently partnered with a nearby hotel called RiverSuites at the Battery.

limited information

Rivers did not disclose whether the hack resulted in workers' information being shared on the dark web, whether ransom was demanded, the number of employees affected and whether guest data was seized.

The letter said only that the breach “involved unauthorized access.” Responding to a request for comment from philadelphia enquirerRiver spokesman Jack Horner said that “an unauthorized actor accessed and/or took certain files stored on our computer servers.”

One of the largest class-action settlements involving a data breach came in September 2017 when Equifax confirmed that the personal information of 147 million people was stolen as a result of a cyberattack. The consumer credit reporting agency agreed to a $425 million settlement, funds that were distributed to those affected to compensate them for their out-of-pocket expenses and time spent dealing with the incident.

casino desirable goal

The US commercial and tribal gaming industries are desirable targets for hackers. Federal law enforcement say that with a treasure trove of data from millions of players, the number of ransomware incidents has increased rapidly over the past decade.

Following the high-profile attacks of MGM Resorts and Caesars Entertainment in 2023, the FBI sent a Private Industry Notification to the casino industry warning that trends continue to suggest that gaming operators are favorable targets. The federal law enforcement agency encouraged casinos to review its “mitigation” recommendations to better protect their IT systems.

The July 2023 alert states that the FBI has noted several emerging or continuing trends in the ransomware environment and is issuing this notification for industry awareness. “New trends include ransomware actors exploiting vulnerabilities in vendor-controlled remote access to casino servers, and companies being victimized through legitimate system management tools to escalate network permissions.”

MGM and Caesars were compromised by so-called “social engineering”, the act of tricking someone into providing access to a computer network or server. Caesars paid a ransom of $15 million to retain its Las Vegas operations. MGM did not do so, causing the company to lose over $100 million in revenue.