Rivers Casino and Rush Street Gaming listed by Cicada3301

• Ransomware group: Cicada3301
• Country: United States
• Sector: Hospitality
• Announcement date: February 4, 2025

Cicada3301 claims data breach against Rivers Casino and Rush Street Gaming

The threat actor known as Cicada3301 has listed Rivers Casino and Rush Street Gaming on its leak site, claiming to possess a significant volume of stolen information. The announcement, made on February 4, 2025, alleges that the group has gained access to a massive dataset totaling 2.561 TB of data belonging to the organization.

This type of activity is characteristic of modern ransomware operations, which often employ a double extortion tactic. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to publish confidential information on a public leak site, the threat actors attempt to pressure the victim into paying a ransom to prevent the exposure of their proprietary or sensitive documents.

Details of the alleged data theft

According to the claims made by the Cicada3301 group, the stolen dataset is comprised of various operational and administrative documents. To support their claims of a successful breach, the threat actor has provided screenshots as evidence. These images reportedly showcase a variety of internal documentation that highlights the scope of the alleged intrusion.

The specific types of data mentioned in the leak include:

• Inspection forms
• Tax returns
• Operational documents

The presence of such documents suggests that the attackers may have gained access to sensitive administrative and financial records. While the group has provided visual evidence, no specific ransom demand has been made public in the announcement, and the exact number of files contained within the 2.561 TB dataset remains unknown.

About Rivers Casino and Rush Street Gaming

Rivers Casino is a chain of casino and entertainment facilities operated by Rush Street Gaming. The company maintains various locations across the United States and provides a wide range of services within the hospitality, gaming, and entertainment sectors. Given the nature of their business, the organization manages complex operational schedules and significant financial transactions across multiple jurisdictions.

Potential risks and organizational implications

This alleged breach may pose significant risks to the organization's operational continuity and customer trust. The inclusion of tax and audit documents in the reported leak could lead to the exposure of the organization's financial and administrative processes, potentially revealing sensitive internal workflows or fiscal details.

Because the organization operates within the United States, the breach may result in legal consequences under state-level data protection laws and regulations. Furthermore, the publication of such data may bring about secondary risks, such as identity theft or targeted phishing attacks against employees and stakeholders. When administrative and operational documents are leaked, attackers often use the information to craft highly convincing social engineering campaigns, targeting specific individuals within the company or its business partners.

In the hospitality and gaming sectors, maintaining the integrity of operational schedules and administrative records is vital for security and compliance. Organizations facing such threats typically focus on strengthening their defensive posture through several key steps. This includes implementing robust multi-factor authentication (MFA) across all administrative access points, maintaining rigorous patch management to close vulnerabilities, and conducting regular security awareness training to help staff recognize phishing attempts. Additionally, organizations often deploy advanced monitoring tools to detect unusual data exfiltration patterns that might indicate a breach in progress. Public information regarding the Cicada3301 group remains limited, making it difficult to attribute the attack to a specific known entity or to predict their future tactics.