Riverside Resort & Casino $1.5M Data Breach Settlement, $50 or $75 Cash, Up to $3,000 in Losses, Claim by January 4, 2027

Riverside Resort & Casino has agreed to settle a class action over a July 2024 cyberattack that potentially exposed the personal information of roughly 55,155 people. Eligible class members can claim a flat cash payment of about 50(75 for California residents) with no receipts, or ask for up to $3,000 in reimbursement for documented losses. Everyone who qualifies can also claim one year of free credit monitoring.

The case is Dapello, et al. v. Riverside Resort & Casino, Inc. and Riverside Resort & Casino, LLC, Case No. 2026CV000097, in the Circuit Court for Columbia County, Wisconsin. Riverside denies wrongdoing, and the court has not ruled on the merits of the claims.

One detail trips up a lot of readers. The “$1.5 million” in the headlines is not a pot of money for victims. Cash benefits to class members are capped at $1 million, and a separate request of up to $500,000 covers attorneys’ fees and costs. More on that below.

Claim deadline: January 4, 2027. Opt-out and objection deadline: December 4, 2026.

Quick Facts

Detail	Information
Defendants	Riverside Resort & Casino, Inc. and Riverside Resort & Casino, LLC
Business location	Laughlin, Nevada
Case	Dapello, et al. v. Riverside Resort & Casino, Inc., et al.
Case number	2026CV000097
Court	Circuit Court for Columbia County, Wisconsin
Headline settlement figure	About $1.5 million
Cap on cash benefits to class members	$1,000,000
Attorneys’ fees and costs requested	Up to $500,000, paid by Riverside
Attack discovered	July 25, 2024
Individual notices began	September 5, 2024
Reported affected people	55,155
Flat cash payment	About 50(75 in California)
Documented losses	Up to $3,000
Lost time	Up to $60 (inside the $3,000 cap)
Credit monitoring	One year of CyEx Financial Shield Total
Claim form required	Yes
Opt-out and objection deadline	December 4, 2026
Claim deadline	January 4, 2027
Final approval hearing	January 27, 2027
Settlement administrator	Simpluris, Inc.
Official website	riversidedatasettlement.com

What Happened in the Riverside Data Breach?

Riverside Resort & Casino operates a hotel and casino in Laughlin, Nevada. On July 25, 2024, the company discovered suspicious activity in its computer systems. It brought in cybersecurity and data-privacy specialists, and by August 9, 2024 it had identified the people whose information may have been affected.

Riverside began mailing individual notification letters on September 5, 2024. According to the notice, an unauthorized third party potentially accessed and acquired certain files. Public reporting at the time said the ransomware group Lynx claimed responsibility on its leak site. That claim came from the group itself, and it isn’t something the settlement documents confirm.

The plaintiffs allege Riverside failed to use reasonable security measures to protect the sensitive information it collected and stored. Riverside denies that. Nothing in the settlement is a finding that the company broke the law or caused the attack.

How many people were affected?

The first complaint, filed in September 2024, alleged at least 55,150 people were affected. A breach record filed with the Maine Attorney General lists 55,155 people, including 16 Maine residents.

Those figures describe the reported size of the incident. The settlement’s eligibility rule is narrower, and it turns on whether you were sent a notice (see below).

What personal information was involved?

There are two descriptions, and they don’t match exactly.

The September 5, 2024 notification letter said names and Social Security numbers were potentially accessed.

The settlement website describes a wider range of information that the affected files may have contained:

• Names and residential addresses
• Social Security numbers
• Driver’s license and government-issued ID numbers
• Financial account numbers and credit or debit card numbers
• Medical information and health insurance information
• Dates of birth
• Other personally identifiable or protected health information

That broader list does not mean every person’s file held every category. The letter you personally received is the best guide to what Riverside says was exposed in your case.

Timeline of the Riverside Data Breach and Lawsuit

Date	Event
July 25, 2024	Riverside discovers suspicious activity on its systems
August 9, 2024	Riverside identifies the people whose information may be affected
September 5, 2024	Notification letters begin going out
September 16, 2024	A proposed federal class action over the same incident is filed in Nevada (No. 2:24-cv-01732)
September 4, 2026	The Wisconsin settlement receives preliminary court approval, per settlement reporting
October 5, 2026	Settlement notices begin mailing, per settlement reporting
December 4, 2026	Deadline to opt out or object
January 4, 2027	Deadline to file a claim
January 27, 2027	Final approval hearing

Two different case numbers are floating around online. The earlier federal complaint is No. 2:24-cv-01732 in Nevada. The current settlement is No. 2026CV000097 in Wisconsin. Use the Wisconsin number when you contact the administrator or look up the case.

Who Qualifies for the Settlement?

The official class definition reads: all persons residing in the United States who were sent notification that their private information was compromised because of the data incident Riverside discovered in or around July 2024.

In plain terms, you likely qualify if:

• You live in the United States,
• Riverside sent you a notice saying your private information was compromised in the July 2024 incident, and
• You don’t exclude yourself by the deadline.

The class isn’t limited to casino guests. Current and former employees and others whose information Riverside held can qualify if they received the notice.

Excluded: Riverside and its officers, directors and related companies; the attorneys for the parties; and the judge, along with the judge’s family and staff.

Do you have to prove identity theft?

No, not for the flat cash payment. You only need to submit a valid claim form. Proof matters if you’re asking for reimbursement of actual losses.

What if you never got a notice?

Staying at the hotel, gambling there or buying something there doesn’t make you a class member on its own. The class is built around receiving the notice. If you think you should have gotten one, contact the administrator with your full name and mailing address and ask whether you’re in the records:

• Phone: (833) 200-8003
• Email: [email protected]

Settlement Benefits: What You Can Claim

There are two cash routes and one non-cash benefit. You pick one cash route, and you can add the credit monitoring to either.

Option 1: Flat cash payment, no receipts

Where you live	Expected payment
California	About $75
Any other U.S. state	About $50

No documentation is required. The amount is an estimate, not a promise. If valid claims push total cash payments past the $1 million cap, every payment is cut proportionally. The amount can also go up if fewer people claim than expected.

Option 2: Up to $3,000 for documented losses

If the breach cost you money, you can ask to be reimbursed instead. Covered losses must have happened between July 25, 2024 and January 4, 2027, and they can include:

• Money lost to identity theft or fraud tied to the incident
• Credit reports, credit monitoring and credit freeze or unfreeze fees
• Replacing a driver’s license or other ID
• Postage for contacting banks about the incident

You need supporting records such as bank or card statements, receipts or other proof. Notes you wrote yourself can help explain other documents, but they aren’t enough alone. You can’t claim anything someone else has already reimbursed.

Lost time

You can claim up to three hours at $20 an hour, for a maximum of $60, for time spent dealing with the incident. That might mean changing passwords, checking accounts for suspicious activity or researching the breach.

Time spent	Maximum
1 hour	$20
2 hours	$40
3 hours	$60

The $60 sits inside the $3,000 cap. It isn’t extra.

Can you claim both the flat payment and the $3,000?

No. The flat payment is an alternative to the documented-loss option. If you have real receipts for fraud or breach-related costs, Option 2 may pay more. If you didn’t lose money or can’t document it, Option 1 is simpler.

Credit monitoring

All class members can claim one year of CyEx Financial Shield Total, which includes monitoring for identity theft and fraud, unauthorized financial transactions and high-risk uses of your personal information. It also includes up to $1 million in financial fraud insurance and access to a fraud-resolution agent if something goes wrong.

That $1 million is insurance coverage inside the monitoring product. It’s not a payout to you or to the class.

If you already enrolled in the 12 months of Cyberscout monitoring Riverside offered in its 2024 letter, the settlement monitoring is a separate benefit. Read the enrollment terms when you select it.

Why Is It Called a $1.5 Million Settlement?

Component	Amount
Cap on cash benefits to class members	$1,000,000
Attorneys’ fees and costs requested	Up to $500,000
Combined headline figure	$1,500,000

The $500,000 request comes from Class Counsel, A. Brooke Murphy of Murphy Law Firm and Alex Phillips of Strauss Borrelli PLLC. Riverside is to pay it separately from the class benefits. Class counsel will also ask the court to approve service awards of $2,000 for each class representative (11 people, up to $22,000 total), also paid by Riverside. Notice and administration costs and the credit monitoring are separate settlement expenses.

So the headline is a combination of numbers. It doesn’t mean $1.5 million will be divided among people affected by the breach. The most that can go to class members in cash is $1 million, and the court still has to approve the final terms.

How to File a Claim

A claim form is required to receive any benefit. Deadline: January 4, 2027, for online claims or paper forms postmarked by that date.

File online

Go to the official claim page at riversidedatasettlement.com/form/claim. You’ll need the Login ID and PIN printed on your settlement notice. Enter them to open the form, pick your benefit and fill in the required information.

Lost your notice? Email or call the administrator and give your full name and mailing address so they can look up your Login ID and PIN. Don’t pay anyone who offers to “unlock” or file a settlement claim for a fee. The real claim process is free.

File by mail

Download the official claim form PDF, complete and sign it, and attach supporting documents if you’re asking for reimbursement. Mail it to:

Riverside Data Incident Settlement c/o Settlement Administrator P.O. Box 25226 Santa Ana, CA 92799-9958

Documents worth gathering for a loss claim

• Bank and credit card statements showing unauthorized charges
• Receipts for replacing ID, credit freezes or credit reports
• Records of expenses you paid while responding to the breach
• A short written note explaining how each expense connects to the incident

Keep a copy of everything you submit. You don’t need receipts for the flat payment.

Deadlines and Your Four Options

Action	Deadline
Request exclusion (opt out)	December 4, 2026
File an objection	December 4, 2026
Submit a claim online	January 4, 2027
Mail a claim form	Postmarked by January 4, 2027
Final approval hearing	January 27, 2027

1. Submit a claim. This is the only way to receive a payment or the credit monitoring.

2. Opt out. You get no benefits, but you keep whatever right you may have to sue Riverside on your own over the released claims. A valid request must include your full name, address, phone number, email, signature, the case name and a clear statement that you want out. It must be postmarked or emailed by December 4, 2026, and sent to Riverside Data Incident Settlement, ATTN: Exclusion Request, P.O. Box 25226, Santa Ana, CA 92799-9958.

3. Object. You stay in the class and tell the court what you don’t like, such as the $1 million cap, the payment amounts, the $3,000 limit, the fees or the service awards. Objections must be filed with the court by December 4, 2026, with a copy sent to the administrator. You can’t object if you’ve opted out.

4. Do nothing. You receive no benefit, and if the court grants final approval you are still bound by the settlement and its release of claims. In other words, ignoring the notice can cost you the right to sue Riverside over these issues without getting paid anything.

When Will Payments Go Out?

There’s no confirmed payment date. The court will hold the final approval hearing on January 27, 2027, and payments follow only after final approval and after any appeals are resolved. The administrator also has to process claims and check documentation before it sends anything.

At the hearing, the judge will consider whether the settlement is fair, reasonable and adequate, whether to award the requested fees and costs, whether to approve the service awards and any timely objections. Class members don’t have to attend. Hearing details can change, so check the official website before planning to show up. Settlement reporting lists the hearing time as 11:00 a.m. Central at the Columbia County Courthouse in Portage, Wisconsin.

The Law Behind the Riverside Lawsuit

The following is background to help you understand the claims. These are allegations by the plaintiffs, not findings that Riverside violated any statute.

Claims in the original federal complaint

The 2024 federal complaint alleged negligence, breach of fiduciary duty, breach of confidence, breach of express contract, breach of implied contract and unjust enrichment. It also alleged Riverside could have prevented the intrusion by encrypting the data or destroying information it no longer needed. None of that has been proven in court.

Nevada: NRS Chapter 603A

Because Riverside operates in Nevada, its obligations may be shaped by Nevada’s Security and Privacy of Personal Information law.

• NRS 603A.210 requires a data collector that maintains personal information about Nevada residents to implement and maintain reasonable security measures against unauthorized access, acquisition, destruction, use, modification or disclosure.
• NRS 603A.220 requires a data collector to notify Nevada residents when their unencrypted personal information has been, or is reasonably believed to have been, acquired by an unauthorized person. Notice must go out in the most expedient time possible and without unreasonable delay, subject to law-enforcement needs and the time required to determine the scope of the breach and restore system integrity.
• NRS 603A.215 addresses encryption and security standards for data collectors that accept payment cards and for the movement of personal information outside secured systems. It becomes relevant mainly where card data is involved.

The allegation that some information was stored unencrypted appeared in the earlier complaint and is not a court finding in the settlement case.

Other states’ breach-notification and security laws

The notice list covers people in many states, so each recipient’s home-state law may apply to them. Wisconsin’s breach-notification statute, Wis. Stat. § 134.98, requires covered entities to notify affected Wisconsin residents within a reasonable time, not to exceed 45 days after learning of the acquisition, with limited exceptions. California residents have additional protections under Cal. Civ. Code § 1798.81.5 (reasonable security) and § 1798.82 (breach notification).

California Consumer Privacy Act: why California may be treated differently

The California Consumer Privacy Act includes a private right of action, Cal. Civ. Code § 1798.150, for certain data breaches caused by a business’s failure to maintain reasonable security. It allows statutory damages of $100 to $750 per consumer per incident, or actual damages if greater. That legal exposure is the commonly cited reason data breach settlements often pay California residents more. The settlement materials don’t say why the California payment is $75, so treat that as background, not as the stated reason.

Federal law

• FTC Act, Section 5 (15 U.S.C. § 45) lets the Federal Trade Commission pursue companies for unfair or deceptive practices, which can include unreasonable data security. It doesn’t give individuals a private right to sue, so it isn’t the basis of this class action.
• HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) applies to covered entities and business associates handling protected health information. The settlement website mentions medical information, but the published materials don’t say whether HIPAA applies to Riverside’s records, so I’m not assuming it does.
• Fair Credit Reporting Act (15 U.S.C. § 1681c-1) gives every consumer the right to place and lift a credit freeze for free and to place fraud alerts. This is separate from the settlement, and it costs nothing.

The constitutional hurdle in many data breach suits is standing. Under TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), federal courts require a concrete harm, not just a risk of future harm, for damages claims. That is one reason defendants contest these cases and one reason settlements like this one are structured as compromises.

Wisconsin: class action settlement approval

The settlement is pending in Columbia County, Wisconsin. Under Wis. Stat. § 803.08, a class action settlement needs court approval. The court must direct reasonable notice to class members and may approve only after a hearing and a finding that the settlement is fair, reasonable and adequate. That’s why signing the agreement didn’t end the case, and it’s why the January 27, 2027 hearing matters.

Why a Nevada casino’s settlement is in a Wisconsin court

It looks odd, and the public materials don’t explain it. The earlier federal case was filed in the District of Nevada, and the published settlement documents don’t spell out why the parties settled in Wisconsin or what happened to the federal docket. It’s safest not to guess. If it matters for your decision, read the settlement agreement or ask the administrator.

Steps to Take to Protect Yourself After a Data Breach

Claiming money doesn’t protect you from fraud. If you got a Riverside notice, these steps are worth doing regardless of the settlement:

• Place a free credit freeze with Equifax, Experian and TransUnion.
• Check your credit reports for free at AnnualCreditReport.com.
• Review bank and card statements for charges you don’t recognize.
• Turn on multi-factor authentication for banking, email and other important accounts.
• Watch for phishing emails, texts and calls that use details from the breach.
• If someone misuses your identity, report it at IdentityTheft.gov and keep records of your time and expenses, because they may support a loss claim.

If your Social Security number was exposed, consider an IRS Identity Protection PIN to help prevent someone filing a tax return in your name.

Do Settlement Payments Count as Taxable Income?

Possibly. The tax treatment of a settlement payment can depend on what it compensates you for and on your own situation. Reimbursement of out-of-pocket costs is often treated differently from a flat payment. This article doesn’t give tax advice, so ask a qualified tax professional if the amount matters to you.

Frequently Asked Questions About the Riverside Resort & Casino Data Breach Settlement

Is the Riverside Resort & Casino data breach settlement legitimate?

Yes. It is a court-supervised class action settlement in Dapello, et al. v. Riverside Resort & Casino, Inc., Case No. 2026CV000097, in the Circuit Court for Columbia County, Wisconsin. Simpluris, Inc. administers it, and final approval is still pending.

How much can I receive from the Riverside settlement?

You can claim either a flat payment of about 50(75 for California residents) with no receipts, or up to $3,000 for documented losses, which includes up to $60 for lost time. Both are subject to proportional reduction because cash benefits are capped at $1 million. One year of credit monitoring is available with either option.

Can I claim both the $50 payment and the $3,000 reimbursement from Riverside?

No. The flat payment is an alternative to the documented-loss option. Credit monitoring can be added to either.

Do I need a Login ID and PIN to file a Riverside settlement claim?

Yes, for the online form. Both are printed on your settlement notice. If you lost the notice, contact Simpluris at (833) 200-8003 or [email protected] with your full name and mailing address.

Do I have to prove identity theft to get the Riverside settlement payment?

No. The flat $50 or $75 payment doesn’t require proof of fraud or receipts. Reimbursement of actual losses does require supporting documents.

What is the Riverside Resort & Casino settlement claim deadline?

January 4, 2027, for online claims or paper forms postmarked by that date.

What are the opt-out and objection deadlines in the Riverside settlement?

Both are December 4, 2026. An exclusion request must be postmarked or emailed by that date, and an objection must be filed with the court and copied to the administrator.

What information was exposed in the Riverside data breach?

Riverside’s September 2024 notice said names and Social Security numbers were potentially accessed. The settlement website describes a wider range of information the files may have contained, such as financial, ID and medical information. That doesn’t mean every person’s file held every category, so check the letter you received.

Is the $1 million in credit monitoring insurance a cash payment?

No. It is financial fraud insurance included in the CyEx Financial Shield Total service, not a payout to you or to the class.

Who qualifies for the Riverside data breach settlement?

U.S. residents who were sent notice that their private information was compromised in Riverside’s July 2024 data incident, other than the excluded parties. Staying at the hotel or visiting the casino doesn’t qualify you on its own.

What happens if I do nothing about the Riverside settlement?

You get no benefit, and if the court grants final approval you may still be bound by the settlement’s release of claims.

When will Riverside settlement payments be sent?

There’s no confirmed date. The final approval hearing is January 27, 2027, and payments follow final approval and the resolution of any appeals.

Does Riverside Resort & Casino admit responsibility for the data breach?

No. Riverside denies wrongdoing, and the settlement isn’t a finding of liability.

The Bottom Line

If Riverside sent you a breach notice, you have a free way to claim something. Most people with no documented losses will choose the flat payment of about 50(75 in California), and anyone with receipts for breach-related costs should look hard at the $3,000 option. Credit monitoring is available either way.

Keep three things straight. The $1.5 million headline isn’t what class members share, since the cash pool is capped at $1 million. Doing nothing means no payment and still being bound by the release. And the deadlines are real: December 4, 2026 to opt out or object, and January 4, 2027 to claim. The court decides on final approval on January 27, 2027, and money moves only after that.

Official Settlement Documents and Sources

Settlement website and documents

1. Official settlement website
2. Settlement FAQ
3. Online claim form
4. Settlement documents
5. Administrator contact page
6. Claim form PDF
7. Notice of Class Action Settlement PDF
8. Settlement Agreement PDF

Breach and litigation background

9. Maine Attorney General breach notice
10. Original Riverside notification letter
11. Original federal complaint, No. 2:24-cv-01732

Legal authorities

12. Nevada Revised Statutes Chapter 603A
13. Wisconsin Statutes § 803.08, Class Actions
14. Wisconsin Statutes § 134.98; California Civil Code §§ 1798.81.5, 1798.82 and 1798.150; 15 U.S.C. §§ 45 and 1681c-1; 45 C.F.R. §§ 164.400–414
15. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)

Related AllAboutLawyer coverage

• CBIZ $485,000 Data Breach Settlement, Claim Up To $5,000
• Communications Data Group Settlement, File By Nov. 10
• Benworth Data Breach Settlement, Claim 50–5,000 By Dec 21

About the author: Researched and written by Israr Ahmad using the official settlement website and notices, government breach-reporting records, court filings, administrator instructions and the statutes cited above.

Disclaimer: AllAboutLawyer.com is an independent legal information website. It is not a law firm and does not provide legal advice, and nothing here creates an attorney-client relationship. This article summarizes a proposed settlement and allegations that have not been proven. The settlement is subject to final court approval, and benefit amounts, eligibility and documentation rules depend on the final approved agreement and the administrator’s review. Statutes can change, so confirm current law with a licensed attorney before relying on it for your situation.