Rivers Casino and Rush Street Gaming Listed by cicada3301 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations that hold large volumes of operational and customer data, listing victims on leak sites as part of double-extortion campaigns. In this environment, claims of data theft against gaming and casino operators draw particular attention because of the sensitive personal and financial information such businesses routinely process.

On 12 August 2023, the ransomware group cicada3301 listed Rivers Casino and Rush Street Gaming on its leak site, claiming to have exfiltrated internal files in a ransomware attack. Public detail on the incident remains limited; the number of people affected is unknown, and the precise contents of the taken data have not been independently confirmed. The listing itself is a claim by the group and should be treated as unverified unless corroborated by the organisation or official investigators.

What happened

According to the available record, Rivers Casino and Rush Street Gaming were listed by cicada3301 on or around 12 August 2023. The group’s leak-site entry described the matter as a ransomware attack in which internal files were allegedly exfiltrated. The reported summary accompanying the listing gave a data size of 2.561 TB and a status timer reading 11 days, 21 hours, 12 minutes and 26 seconds. No further public detail has been supplied about the initial access method, the exact date of intrusion, whether systems were encrypted, or whether any ransom demand was paid or refused. The number of individuals potentially affected is recorded as unknown.

Who is cicada3301?

cicada3301 is a ransomware operation that has appeared in public reporting as a double-extortion actor: it claims to steal data before or alongside encryption and then threatens to publish the material if its demands are not met. Like other groups in this category, it has used dedicated leak sites to name alleged victims and to post samples or larger archives as pressure tactics. Public analyses have associated the name with activity that emerged in the broader ransomware ecosystem around 2023, sometimes linked by researchers to earlier brands or shared tooling, though exact lineage claims vary. The group’s listings are assertions made by the actors themselves; they do not constitute independent confirmation that a breach occurred or that every file claimed was in fact taken.

Who is Rivers Casino and Rush Street Gaming Listed by cicada3301 Ransomware Group?

Rivers Casino properties and Rush Street Gaming operate in the casino and online gaming sector. Organisations of this type typically manage customer accounts, loyalty programmes, payment processing, employee records, and extensive internal operational files. They also handle regulatory and compliance documentation common to licensed gaming. A claimed breach against such an operator is consequential because the sector concentrates both personal identifiers and financial data, and because disruption or data exposure can affect patrons, staff, and business partners across multiple jurisdictions. The listing names Rivers Casino and Rush Street Gaming together; public detail does not further separate which specific entities or systems were allegedly involved.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack and that the claimed volume was 2.561 TB. No itemised inventory of data types—such as customer names, contact details, payment card data, government identifiers, employee records, or proprietary business documents—has been disclosed in the available record. Organisations in the casino and gaming industry commonly hold precisely these categories of information. Because the exact contents remain unconfirmed, it is not possible to state as fact what was taken. Anyone who has held an account, worked for, or otherwise shared personal information with the named operators should treat the possibility of exposure as unresolved until official notifications or verified disclosures appear.

Why it matters

If internal files of the claimed scale were removed, affected individuals could face risks that include phishing and social-engineering attempts that reference real account or employment details, fraudulent use of financial or identity data, and longer-term identity-related harm. For the organisation, consequences can include regulatory scrutiny, notification obligations, operational disruption, and reputational damage—regardless of whether a ransom was paid. Because the number of people affected is unknown and the data types are not itemised, the practical scope of harm cannot yet be measured. Calm monitoring of official statements from the companies and from relevant regulators remains the most reliable way to assess personal impact.

Were you affected?

If you have been a customer, employee, or partner of Rivers Casino or Rush Street Gaming, watch for any direct notification from the organisation. Consider placing fraud alerts with major credit bureaus, reviewing account statements for unfamiliar activity, and treating unexpected messages that reference the companies with caution. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. Public confirmation of this specific incident’s full scope is still limited; official channels from the companies remain the primary source for verified guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.