Lawsuits against Boyd Gaming for recent data breach are piling up

Four more lawsuits have been filed in U.S. District Court in Nevada against Boyd Gaming Corp. for failing to protect personally identifying information stolen by cybercriminals in a data breach that was believed to have occurred in September.

The four new lawsuits filed by three different attorneys seek to create a class action involving thousands of Boyd Gaming employees, ex-employees and customers.

Boyd has a policy of not commenting on pending litigation.

The new lawsuits, each submitted Monday, followed a similar filing Thursday by former Boyd employee and Las Vegas resident Scott Levy. His lawsuit also proposes a class action.

Boyd operates 11 casinos in the Las Vegas Valley, including three properties in downtown Las Vegas, and has 17 other gaming locations spread across 10 states, and the company manages a California tribal casino.

In a Securities and Exchange Commission filing Sept. 23, the company said the attackers removed certain data from its systems, including employee information and records tied to “a limited number of other individuals.” Boyd said it has started notifying those affected and will alert regulators and government agencies as required.

The plaintiffs in the new lawsuits reside in Las Vegas, Texas, Louisiana and Ohio.

Boyd has not said when the data breach occurred, but one of the new lawsuits said it happened Sept. 5-7. The company also has not disclosed whether it paid a ransom to regain access to the company’s computers.

Newest complaints

Details of the new complaints:

Deandric Price identified himself as a victim of the data breach living in Las Vegas. According to the three-count complaint that accuses Boyd of negligence, breach of implied contract and “breach of the implied covenant of good faith and fair dealing,” the company knew of the breach well before it notified the SEC.

“While defendant claims to have discovered the breach as early as Sept. 6, defendant did not begin informing victims of the data breach until much later and failed to inform victims when or for how long the data breach occurred. Indeed, representative plaintiff and class members were wholly unaware of the data breach until they received letters from defendant informing them of it.” Price is represented by Reno attorney David Wise of the Wise Law Firm.

Sherekia Price is a resident of Louisiana, where Boyd operates five casinos and racinos. The lawsuit alleges the data breach “impacted several thousand individuals.” The lawsuit accuses Boyd of negligence, and Price is represented by Matthew Knepper of Las Vegas-based Knepper Litigation LLC.

Plaintiff Larry Harris is a resident of Texas, where residents often drive to Louisiana to gamble.

The lawsuit says, “Through its investigation, defendant determined that that unauthorized activity began Sept. 5 and Sept. 7.”

The lawsuit accuses Boyd of “intentionally, willfully, recklessly or negligently failing to implement and maintain adequate and reasonable measures to ensure that the private information of plaintiff and class members was safeguarded, failing to take available steps to prevent an unauthorized disclosure of data.”

The seven-count action brought by Wise accuses Boyd of negligence, negligence per se, unjust enrichment, invasion of privacy, breach of fiduciary duty, breach of implied contract, and asks for a declaratory judgment on behalf of the class.

Patricia Tiedtke is a resident of Cincinnati, where Boyd operates Belterra Park Cincinnati.

The lawsuit says, “Defendant has intentionally obfuscated the nature of the breach and the threat it posted — how the breach happened and why defendant continues to delay notifying victims the full extent that hackers had gained access to the plaintiff and class members’ (personal information).”

In the lawsuit, Tiedtke said she is “unaware of how defendant acquired her personal information as defendant, to the best of plaintiff’s knowledge, has never been a customer, employee or client of the defendant.” The two-count complaint accuses Boyd of negligence and negligence per se and invasion of privacy, and she’s represented by Nathan Ring of Las Vegas-based Stranch, Jennings and Garvey, which also is representing Levy in the first filed lawsuit.

Contact Richard N. Velotta at rvelotta@reviewjournal.com or 702-477-3893. Follow @RickVelotta on X.