A Clark County, Nevada woman has filed a class action lawsuit against Station Casinos and its parent company, Red Rock Resorts Inc., alleging the locals casino company failed to adequately protect customer data exposed in a cyberattack that occurred in March 2026. Plaintiff Susan Geiner filed the complaint on May 29 in U.S. District Court in Nevada, both individually and on behalf of a broader class of potentially affected customers. The lawsuit was filed by the Las Vegas-based Freedom Law Firm and Ahdoot and Wolfson of King of Prussia, Pennsylvania.
Station Casinos publicly confirmed the breach to cybersecurity media outlet Cybernews on May 22, 2026, the day after the company began notifying potentially affected customers. Along with the notifications, Station offered free credit monitoring and identity theft protection services to those whose information was compromised. The breach, which took place on March 5, involved unauthorized access to sensitive customer personal information, including names and personal identification data.
The Lawsuit's Claims
The lawsuit argues that Station Casinos should have recognized the significant appeal of its customer database to cybercriminals and implemented stronger security measures accordingly. The filing alleges that the company's internal systems were inadequate and failed to detect the intrusion in real time. The complaint specifically challenges the absence of effective endpoint detection and response tools, arguing that the hackers were able to conduct what it describes as overt and noisy operations without triggering alerts — evidence, the filing claims, of systemic security failures rather than a sophisticated attack that could not have been prevented.
Geiner seeks a jury trial along with actual damages, statutory damages, equitable relief, restitution, and disgorgement. The lawsuit also requests that the court require Station Casinos to cover the cost of notifying class members, administering any claims process, and paying attorneys' fees. The full scope of the affected customer population has not been publicly disclosed.
A Pattern in Nevada's Casino Industry
The Station Casinos breach is the fifth major cyberattack to hit a large Nevada casino operator in less than three years. MGM Resorts and Caesars Entertainment were both hit by high-profile ransomware attacks in September 2023, with MGM's incident resulting in an estimated $100 million in losses and widespread operational disruptions across its Las Vegas Strip properties. Golden Entertainment and at least one other major operator have also disclosed breaches in the intervening period.
The frequency of attacks on Nevada casino operators has drawn the attention of state regulators and cybersecurity experts, who note that the industry's combination of vast customer data, 24-hour operations, and complex legacy technology systems makes it a particularly attractive target. Station Casinos operates several major Las Vegas Valley resort properties, including Red Rock Casino Resort and Spa, Palms Casino Resort, and Green Valley Ranch Resort Spa Casino.
The Station Casinos case is expected to proceed through the federal court system over the coming months. Whether it will advance to a full class certification depends on the court's assessment of whether the affected customers share sufficiently common legal claims to warrant class treatment. Similar class actions stemming from the 2023 MGM and Caesars breaches are still working their way through the legal system, providing a preview of the long road ahead for plaintiffs and the company alike.
