Rivers Casino Philadelphia Informs Employees of Data Breach

Posted on: January 7, 2025, 03:29h. 

Last updated on: January 7, 2025, 03:29h.

Devin O'Connor @CasinoorgDevinO Read More

Expertise: Asia Pacific Gaming, Commercial Gaming, Legislation, Politics.

Rivers Casino Philadelphia has acknowledged that its computer systems storing sensitive information on employees were compromised last fall.

In a letter to employees, the casino owned and operated by Rush Street Gaming confirmed a “data security incident” that may have compromised personal information. The letter says staff members’ Social Security numbers and banking account information used for direct deposit were possibly seized by a bad actor.

We regret any inconvenience or concern this incident may cause you,” the letter stated. “Rivers Casino Philadelphia recognizes the importance of protecting the personal information we maintain.”

No other Rivers casinos were impacted, Rush officials said. Rivers Philly is offering its impacted employees a one-year membership to credit monitoring services. The company says it has taken additional security measures to better protect and secure its IT network.

Rivers Casino Philadelphia, formerly Sugar House, sits along the Delaware River just northeast of the downtown area. The casino has over 1,500 slot machines, 70 live dealer table games, and a BetRivers Sportsbook. The casino recently partnered with a nearby hotel called Riversuites at The Battery. 

Limited Information

Rivers did not disclose if the hack resulted in worker information being shared on the dark web, whether a ransom was demanded, the number of employees presumed to be impacted, and whether guest data was seized.

The letter said only that the breach “involved unauthorized access.” Responding to a request for comment from The Philadelphia Inquirer, Rivers spokesperson Jack Horner said that the “unauthorized actor accessed and/or took certain files stored on our computer servers.”

One of the largest class-action settlements involving a data breach came in September 2017 when Equifax confirmed that a cyberattack resulted in 147 million people having their personal information stolen. The consumer credit reporting agency agreed to a $425 million settlement, funds that were distributed to compensate those impacted for their out-of-pocket expenses and time spent dealing with the incident.

Casinos Desirable Targets

The U.S. commercial and tribal gaming industries are desirable targets for hackers. With a treasure trove of data on tens of millions of players, the number of ransomware incidences over the past decade has exponentially increased, federal law enforcement says.

Following the high-profile attacks of MGM Resorts and Caesars Entertainment in 2023, the FBI sent a Private Industry Notification to the casino industry warning that trends continue to suggest that gaming operators are favorable targets. The federal law enforcement agency encouraged casinos to review its “mitigation” recommendations to better protect their IT systems.

The FBI noted several trends emerging or continuing across the ransomware environment and is releasing this notification for industry awareness,” the July 2023 warning read. “New trends included ransomware actors exploiting vulnerabilities in vendor-controlled remote access to casino servers, and companies victimized through legitimate system management tools to elevate network permissions.”

MGM and Caesars were compromised by so-called “social engineering,” the act of tricking someone into providing access to a computer network or server. Caesars paid a ransom of $15 million to keep its Las Vegas operations intact. MGM did not, which cost the firm over $100 million in lost revenue.