Station Casinos, the Las Vegas-area operator behind properties including Red Rock Resort and Green Valley Ranch, disclosed a cybersecurity incident that began on March 5, 2026. The company reported the breach to the Maine Attorney General's office on May 21, 2026 — more than two months after the incident — and began notifying affected individuals by mail.
A proposed class-action lawsuit followed. Susan Geiner, described in court filings as a former employee and current customer, filed Geiner v. Red Rock Resorts, Inc. et al. in the U.S. District Court for the District of Nevada on May 28, 2026 (Case No. 2:26-cv-01632). Defendants include Red Rock Resorts, Inc., Station Holdco LLC, and Station Casinos LLC.
What the lawsuit alleges
The complaint alleges that unauthorized actors accessed company systems on or about March 5, 2026, and obtained sensitive personal information belonging to customers and employees. According to the filing and related reporting, categories of data at issue may include names, contact details, dates of birth, driver's license and passport numbers, Social Security numbers, tax information, credit card data, casino credit details, and vehicle information.
Important: These are plaintiff allegations in a civil complaint. No court has found Station Casinos liable. Defendants have sought extensions to respond while related cases move toward consolidation. As of mid-2026, the matter remained in early litigation with no settlement fund or claims process.
Why hospitality and gaming operators draw attackers
Casino operators maintain rich identity and financial profiles on millions of guests — loyalty accounts, credit lines, employment records, and payment histories. That makes them high-value targets even when the headline is not ransomware. The Geiner complaint alleges inadequate safeguards allowed attackers to locate and exfiltrate data without timely detection; Station Casinos has not publicly confirmed the full scope of exposed records or the total number of affected individuals.
If you believe you were affected
Individuals who received a breach notification letter should follow the operator's stated guidance and monitor financial accounts. Class-action litigation may eventually produce relief, but filing a lawsuit is not the same as proving a claim. CasinoTruths will update this story if the company publishes a detailed incident report or if the court certifies a class.