Riverside Resort & Casino data breach settlement (USD 1M): Claim by 4 January 2027, Who Is Covered, Payout Estimate

If the court grants final approval on January 27, 2027, the Riverside Resort & Casino data breach settlement is set to pay class members who file a claim by January 4, 2027 an estimated USD 50 (USD 75 in California) without proof, or up to USD 3,000 for documented losses. The Circuit Court for Columbia County, Wisconsin is handling it.

All cash benefits are capped at USD 1,000,000 in total. About 55,155 people were affected, per the federal order in the earlier Nevada case. No payment date has been set.

Estimated benefit per class member under the notice, subject to final approval; no payment date has been set.

What this case is about

Dapello, et al. v. Riverside Resort & Casino, Inc. and Riverside Resort & Casino, LLC, No. 2026CV000097 in the Circuit Court for Columbia County, Wisconsin, is a class settlement over a July 2024 cyberattack.

A complaint states one side's allegations; only the court's orders decide anything, and the court did not decide whether the plaintiffs or Riverside are right.

The July 2024 ransomware attack and the data exposed

The suit alleges that files holding private information were accessed in a targeted cyberattack on Riverside's computer systems in July 2024, which is one side's account, not a finding.

The notice lists names, addresses, Social Security numbers, driver's license and government ID numbers, financial account and card numbers, medical and health insurance information, and dates of birth as data that may have been involved.

The federal order of September 9, 2025 records that Riverside discovered the attack on July 25, 2024, and the federal record attributes it to Lynx ransomware.

The casino is in Laughlin, Nevada, and the case is one of the casino and sportsbook data breach lawsuits we track, 3 in all as of the November 14, 2026 record.

Why the settlement sits in a Wisconsin state court

The settlement was filed as a new class case in Columbia County, Wisconsin after seven federal suits in Nevada had been consolidated. Those seven putative class actions were filed in September 2024 and consolidated before Judge Gloria M. Navarro in the District of Nevada, No. 2:24-cv-01691.

The plaintiffs dismissed that case without prejudice on May 12, 2026 because the settlement was filed in Wisconsin. The record we read does not say why Wisconsin was chosen, and the Nevada case has its own page. The state page lists every case in the court's state, under gambling lawsuits in Wisconsin.

Who is covered

You are covered if you were sent a notification that your private information was compromised in the data incident Riverside discovered in or around July 2024 and you reside in the United States.

The class definition

The court defined the class as follows.

The figure of about 55,155 is the number of people affected, per the federal order, not a count of notified class members.

Eleven class representatives are named, and class counsel are A. Brooke Murphy of Murphy Law Firm and Alex Phillips of Strauss Borrelli PLLC. No proof of purchase or of a stay is needed for the alternative payment.

Who is not covered

Riverside and its officers, directors and related companies, the parties' attorneys, and the judge with the judge's family and staff are excluded from the class.

People who were not sent a breach notification are outside the definition, and so is anyone who opts out. Residents of other countries are outside the definition as written.

Is there a payout?

Yes, an estimated payout exists: if the court grants final approval, every class member who files a valid claim by January 4, 2027 is set to receive either reimbursement of documented losses up to USD 3,000 or an estimated USD 50 (USD 75 for California residents) without proof, plus one year of credit monitoring, with all cash benefits capped at USD 1,000,000 in total and reduced pro rata above that, and no payment date has been set.

Fees and service awards are paid by Riverside outside the cap. Whether credit monitoring counts toward the cap is not stated in the record we read.

The payout formula: documented losses or a USD 50 payment

Documented losses = actual, documented out-of-pocket losses incurred 2024-07-25 to 2027-01-04, up to USD 3,000 per person
  includes lost time: up to 3 hours x USD 20 = USD 60, counted inside the USD 3,000
  proof (bank statements, receipts) required; own notes alone are not enough; amounts reimbursed by a third party excluded
Alternative cash payment (instead of any other payment) = expected USD 50 (USD 75 for California residents), no proof, "may be larger or smaller depending on the total claims filed"
Credit monitoring = one year of CyEx Financial Shield Total for every class member who claims it (USD 1 million fraud insurance)
Cap = USD 1,000,000 in aggregate on the cash benefits; if claims exceed it, every payment is reduced pro rata
Fees and costs (requested USD 500,000) and service awards (USD 2,000 x 11 representatives) = paid by Riverside; not deducted from the cap
Claim by 2027-01-04 (online, or mail postmarked); final approval hearing 2027-01-27 11:00 CT

A class member chooses either the documented-loss route or the no-proof payment, and everyone can also claim one year of credit monitoring. The USD 50 is an expected amount that may be larger or smaller depending on how many claims are filed.

Lost time counts at up to 3 hours at USD 20, or USD 60, inside the USD 3,000 limit, and expenses another party already reimbursed are excluded. Per-person figures depend on fund, fees, claim rate and caps, and the general method is in class action payout per person.

How the USD 1,000,000 cap works: worked claim-rate table

If valid claims exceed USD 1,000,000, every payment is reduced by the same percentage, so the USD 50 estimate falls as more people claim. The table is derived, not taken from the notice.

Derived estimate; assumes every claimant takes the USD 50 payment; credit monitoring not counted.

The assumptions are that every claimant chooses the USD 50 payment and that credit monitoring is not counted. Documented-loss claims and the USD 75 California payment would reach the cap sooner. No claim rate for this settlement exists in the record, so 20,000 claims is only the break-even point at USD 50.

What the USD 1.5M and USD 3,000 headlines mean

Press headlines that say USD 1.5 million add the USD 1,000,000 benefit cap to the USD 500,000 Riverside has agreed not to take from it, and USD 3,000 is a ceiling on documented losses, not a check. The notice states no combined figure, so the USD 1.5 million is a derived sum.

Class counsel will ask the court for USD 500,000 in fees and costs, and for service awards of USD 2,000 for each of 11 representatives, which is USD 22,000 in total. Riverside pays all of it, and the court rules on fees at the hearing.

Deadlines and how to claim

January 4, 2027 is the claim deadline, December 4, 2026 is the deadline to opt out or object, and the final approval hearing is January 27, 2027 at 11:00 a.m. at the Columbia County Courthouse in Portage, Wisconsin; riversidedatasettlement.com is the administrator's official site.

Filing is free. This site is not a law firm and not the administrator, and we never host a claim form.

Dates from the administrator's FAQ and notice, checked November 14, 2026.

Claim deadline January 4, 2027

The claim can be filed online or by mail, and the steps are the same as in how to file a claim in a gambling settlement, with proof only if you claim losses. The claim takes five steps.

1. Open riversidedatasettlement.com by typing it yourself and choose Submit a Claim.
2. Pick one cash route: documented losses or the alternative payment.
3. Add proof (statements, receipts) if you claim losses.
4. Add credit monitoring enrollment if you want it.
5. Submit online by January 4, 2027, or mail the signed form postmarked by that date to Riverside Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799-9958, and keep your confirmation.

Losses must fall between July 25, 2024 and January 4, 2027, so a loss that happens after today still counts. To tell a real notice from a copy, read how to spot fake settlement and claim sites, then check the case number 2026CV000097 and the administrator's phone, (833) 200-8003.

Opt out or object by December 4, 2026

Opting out removes you from the class, forfeits every benefit and keeps your right to sue Riverside on your own; objecting keeps you in and tells the court why the settlement should not be approved.

An exclusion request must be postmarked or emailed by December 4, 2026 and contain the case name and number, your full name, mailing address, phone, email, signature and the words "Request for Exclusion" or a clear equivalent. It covers only you.

An objection is filed with the Clerk of Court, Columbia County Courthouse, 400 DeWitt Street, P.O. Box 587, Portage, WI 53901 by the same date, with a copy to the administrator, and a person who opted out cannot object. The trade-offs are explained in join, opt out or sue alone in a gambling class settlement.

What happens if you do nothing

If you do nothing you receive no benefit and you still give up the claims the settlement agreement releases (Section VII). We have not read the text of Section VII, so the extent of the release is not confirmed here.

Timeline

The settlement closes a federal case that began in Nevada in September 2024.

Settlements usually move from notice to payment in stages, and how long gambling lawsuits and settlements take shows the typical gaps.

What the court has decided so far

The Columbia County court has authorized the notice and set a final approval hearing for January 27, 2027 at 11:00 a.m.; it has not yet decided whether to approve the settlement, the fees or the service awards.

The court did not decide whether the plaintiffs or Riverside are right. The preliminary approval order was not available to us, so its date and the judge's name are not confirmed in the court record.

The federal court's only merits order, dated September 9, 2025 (ECF 23, Judge Navarro), let the core negligence, implied contract, unjust enrichment, California Consumer Privacy Act, Unfair Competition Law and Nevada Deceptive Trade Practices Act claims proceed and trimmed the rest.

As of October 5, 2026 the status is claims-open; the next dated events are the December 4, 2026 deadline, the January 4, 2027 claim deadline and the January 27, 2027 hearing.

Documents and sources

Every date and figure on this page comes from the administrator's FAQ and home page, the court-authorized notice and claim form, and the federal court's filings, listed here with the copy we read.

• Administrator home page and important dates: primary, read November 14, 2026.
• Administrator FAQ: primary, read in full November 14, 2026.
• Long-form notice of class action settlement: primary.
• Claim form: primary; we never host it.
• D. Nev. order of September 9, 2025, ECF 23: primary, RECAP mirror copy.
• D. Nev. notice of voluntary dismissal, May 12, 2026, ECF 49: primary, RECAP mirror copy.

The Wisconsin docket could not be reached, so no docket link is given. The settlement agreement sits on the administrator's Important Documents page, which loads by script and was not read.

Related cases

Four kinds of related cases explain where this settlement came from and what else is open.

The same breach in federal court and other Riverside cases

The same breach was first litigated in Nevada federal court, and Riverside's other lawsuits sit on its company page.

• Riverside Resort & Casino data breach federal class action: dismissed without prejudice on May 12, 2026.
• Riverside Resort & Casino lawsuits: every case against Riverside.

The casino's home state has its own hub at Nevada gambling lawsuits.

Other casino data breach settlements

Casino data breach settlements in our record differ mainly in fund size, tiers and whether proof is needed.

• Eureka Casino data breach settlement: USD 1,000,000, settled-final on June 12, 2026.
• Crystal Bay Casino data breach settlement: USD 675,000.
• Casino Fandango data breach settlement: claims closed October 28, 2025.
• MGM Resorts data breach settlement: USD 45,000,000, claims closed June 3, 2025.

The Riverside cap is smaller than MGM's but comparable to Eureka's.

Other gambling settlements with claims open

Other claims are open in November 2026 (5 in our record), and the open-claims tracker lists every deadline.

• Pulsz six-state settlement: claims to November 30, 2026.
• High 5 Games Washington verdict: claims to January 4, 2027.

Every deadline is on open gambling class action settlements by deadline.

Questions people ask

Do I need to file a claim to get paid?

Yes; doing nothing earns no payment, and the credit monitoring and both cash options need a claim by January 4, 2027. The gambling settlement eligibility checker shows which open claims fit you.

How much is the Riverside data breach settlement payout per person?

There is no fixed amount: an estimated USD 50 (USD 75 in California) without proof, up to USD 3,000 with proof, cut pro rata if claims pass the USD 1,000,000 cap. Try the gambling settlement payout per person calculator, or read what gambling settlements actually paid each claimant.

When is the Riverside settlement payout date?

None has been set; payments follow final approval on or after January 27, 2027 and the resolution of any appeals. The gaps are explained in claim, exclusion and objection deadlines explained.

Is riversidedatasettlement.com legitimate?

Yes; it is the administrator's site named in the court-authorized notice, and the case number 2026CV000097 appears on it. Never pay to file, and verify by phone, (833) 200-8003, or the P.O. box in the notice; Simpluris is one of the settlement administrators handling gambling cases.

What proof do I need for the USD 3,000 option?

Bank statements or receipts showing the loss; your own notes can support but cannot be the only proof. Amounts a third party already reimbursed do not count.

Can I opt out and sue on my own?

Yes, by a request for exclusion postmarked or emailed by December 4, 2026, which forfeits both benefits. Whether a claim would succeed is a separate question, covered in can you sue a casino or sportsbook.

Does the settlement say Riverside did anything wrong?

The court did not decide who is right; the settlement avoids the cost and risk of trial. The allegations are those described in the notice.

I am a California resident: do I get more?

Yes in one respect: the no-proof payment is expected to be USD 75 instead of USD 50 for California residents. Because it is higher, more California claims would reach the cap sooner, as the table assumption explains.

GamblingLawsuits.org is a non-commercial project. It takes no money from operators, affiliates or law firms. Filing a settlement claim is always free. We are not a law firm and not a settlement administrator.

Last checked: November 14, 2026. Next checks: December 4, 2026, January 4, 2027, January 27, 2027, and weekly while claims are open.