Almeida Law Group is investigating a data breach at Station Casinos, LLC. The breach occurred on March 5th, 2026. If you were affected, contact Almeida Law Group.
About Station Casinos, LLC
Station Casinos LLC is a regional gaming and entertainment company founded in 1976 and headquartered in Summerlin South (Las Vegas), Nevada. It is a subsidiary of Red Rock Resorts, Inc. and owns and operates multiple casino resorts in the Las Vegas Valley, including Red Rock Casino Resort Spa, Green Valley Ranch, Palms Casino Resort, and several other properties offering casino gaming, hotels, restaurants, and entertainment. Because Station Casinos collects personal information from both employees and guests, a breach at the company has the potential to affect a broad range of people.
What Happened?
Station Casinos, LLC was listed in a California Attorney General sample breach notice filed on August 5th, 2026. According to that filing and the company’s own disclosures, on March 5th, 2026, Station Casinos identified suspicious activity on its network. An unauthorized third party had accessed a single employee’s account and associated files. The company launched an incident response, engaged cybersecurity experts, and took steps to secure its systems. According to the California AG notice, the company’s investigation determined on July 10th, 2026, that personal information belonging to some recipients may have been accessed. Confirmed compromised data includes names. Depending on the individual, additional information that may have been accessed includes Social Security numbers, dates of birth, driver’s license numbers, financial account numbers, email addresses, phone numbers, and payment card information. The company initially notified the Maine Attorney General on May 21st, 2026 — approximately 11 weeks after discovery — and the August 5th, 2026 California AG filing appears to reflect a later round of notifications following further investigation. The company stated that the incident had no impact on its properties or business operations.
No threat actor has been publicly identified by Station Casinos or law enforcement. The class action lawsuit filed against the company characterizes the incident as a ransomware attack, and some industry reporting has drawn parallels to the Caesars Entertainment 2023 incident in which a ransom was quietly paid. However, Station Casinos has neither confirmed nor denied ransomware involvement, and those characterizations remain unconfirmed. On May 28th, 2026, a class action lawsuit was filed in U.S. District Court in Nevada by Susan Geiner, a Clark County resident and former Station Casinos employee. The defendants include Station Casinos LLC, Station Holdco LLC, and Red Rock Resorts, Inc. The 51-page complaint alleges negligence, negligence per se, breach of implied contract, unjust enrichment, and invasion of privacy, and faults the company for the 11-week delay between discovery and consumer notification. Additional law firms are also reported to be investigating potential claims.
Key Facts at a Glance
- Company or Organization: Station Casinos, LLC
- Industry: Gaming and Hospitality
- Location: Summerlin South (Las Vegas), Nevada
- Incident type: Unauthorized access to employee account and associated files
- Date of breach: March 5th, 2026
- Date breach discovered: March 5th, 2026
- Date of consumer notification: May 21st, 2026 (initial); August 5th, 2026 (California AG filing)
- Identity theft protection offered: Yes — Experian IdentityWorks credit monitoring and identity theft protection
- Prior breach: No previously disclosed major cybersecurity incidents
- Litigation status: Class action lawsuit filed May 28th, 2026, in U.S. District Court, Nevada (Geiner v. Station Casinos LLC et al.); additional law firms investigating
- Source: California Attorney General sample breach notice; Cybernews; FOX5 Vegas; GamblingNews; Casino.org
What Should You Do?
If you received a notice from Station Casinos, enroll in the complimentary Experian IdentityWorks membership offered by the company as soon as possible — visit the enrollment link provided in your notice and have your activation code ready before the enrollment deadline. Even if you have not yet received a notice, consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) to help prevent new accounts from being opened in your name. Review your bank and payment card statements carefully for any unauthorized charges, and pull your free credit reports at AnnualCreditReport.com to check for accounts or inquiries you do not recognize. If you believe your identity has been misused, visit IdentityTheft.gov for step-by-step guidance and to report the incident.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
