Almeida Law Group is investigating a data breach at Boyd Gaming Corporation. If you were affected, contact Almeida Law Group.
About Boyd Gaming Corporation
Boyd Gaming Corporation is a publicly traded (NYSE: BYD) casino gaming and hospitality company founded in 1975 and headquartered in Las Vegas, Nevada. It operates 27 gaming entertainment properties — including casinos, hotels, dining, and entertainment venues — across 11 states, and also runs Boyd Interactive, an online casino gaming business. The company employs approximately 16,000 people and reported $3.9 billion in annual revenue in 2024. Because the company employs a large workforce across multiple states and collects personal information as part of employment and customer relationships, a breach affecting employee records can expose a significant number of individuals to identity theft risk.
What Happened?
Boyd Gaming Corporation was listed in a Vermont Attorney General breach report summary dated September 24th, 2026, identifying government ID numbers as the category of data involved. The incident was an unauthorized intrusion into the company’s internal IT systems. According to Boyd Gaming’s Form 8-K filed with the SEC on September 23rd, 2025, an unauthorized third party accessed internal systems and removed certain data about employees and a limited number of other individuals. The breach occurred between September 5th, 2025, and September 7th, 2025, and was discovered on September 6th, 2025. Boyd Gaming stated the incident did not affect casino operations and would not materially impact its financial condition. The company began mailing notification letters on September 24th, 2025, and offered two years of free identity protection services through IDX. Boyd Gaming also disclosed the breach to several state attorneys general — including California, Maine, Texas, and New Hampshire — between October 1st and October 6th, 2025. The Vermont AG filing dated September 24th, 2026, appears to represent a later or supplemental report; Vermont’s current breach notice system tracks reports beginning April 17th, 2026, which may account for the later filing date.
According to lawsuits and breach notifications, the data involved includes names, dates of birth, and Social Security numbers — consistent with the “government ID numbers” category listed in the Vermont AG report. At least five class-action lawsuits were filed in U.S. District Court in Nevada shortly after the breach disclosure, beginning with a suit filed by former employee Scott Levy on October 3rd, 2025. Additional suits were brought by plaintiffs from Nevada, Ohio, Louisiana, and Texas, alleging that Boyd Gaming failed to implement adequate cybersecurity measures and delayed informing employees. Boyd Gaming has stated it does not comment on pending litigation. As of initial reporting, no ransomware group had publicly claimed responsibility for the attack. An unverified social media post attributed to an alleged Boyd employee suggested a possible link to threat actors associated with the MGM Resorts and Caesars attacks (connected to ALPHV/BlackCat), but this claim has not been confirmed by the company, law enforcement, or security researchers.
Key Facts at a Glance
- Company or Organization: Boyd Gaming Corporation
- Industry: Casino gaming and hospitality
- Location: Las Vegas, Nevada
- Incident type: Unauthorized access and data removal
- Date of breach: September 5th, 2025 – September 7th, 2025
- Date breach discovered: September 6th, 2025
- Date of consumer notification: September 24th, 2025
- Identity theft protection offered: Two years of free identity protection through IDX
- Prior breach: None identified
- Litigation status: At least five class-action lawsuits filed in U.S. District Court in Nevada; multiple additional law firm investigations announced
- Source: Vermont Attorney General breach report summary; SEC Form 8-K Filing; BleepingComputer; ClaimDepot
What Should You Do?
If you received a notification from Boyd Gaming Corporation, enroll in the two years of free identity protection through IDX before the enrollment deadline stated in your letter. Whether or not you enroll, consider placing a free fraud alert or credit freeze with all three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent new accounts from being opened in your name. Monitor your existing financial accounts closely for unfamiliar activity, and request your free credit reports at AnnualCreditReport.com to check for signs of fraud. If you suspect your information has been misused, visit IdentityTheft.gov for step-by-step guidance on reporting and recovery.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
