Boyd Gaming suffered a cyberattack where hackers infiltrated its IT systems, compromising sensitive data of current and former employees as well as a limited number of customers. The breach led to five class-action lawsuits, with plaintiffs alleging negligence in cybersecurity measures. Affected individuals reported increased spam calls and phishing attempts, while the company failed to notify some victims directly. Though casino operations remained unaffected, the breach exposed personal and employment-related data, triggering legal, financial, and reputational repercussions. The incident aligns with a broader trend of cyberattacks targeting Nevada’s gaming sector, including prior breaches at MGM Resorts and Caesars Entertainment. Boyd Gaming acknowledged the attack in a regulatory filing but did not disclose whether ransomware was involved or if a ransom was paid. The company is relying on cybersecurity insurance to cover costs, including investigations and potential penalties.

Boyd Gaming Corporation, a major casino and entertainment company, suffered a cyber breach in September 2025 where unauthorized actors infiltrated its internal systems and exfiltrated confidential data. The stolen information included employee records (such as Social Security numbers) and data from a limited number of other individuals. While casino and hotel operations remained unaffected, the breach triggered legal action from a former employee, Scott Levy, who filed a class-action lawsuit alleging negligence, breach of implied contract, and violations of Nevada’s Consumer Fraud Act. The lawsuit argues Boyd’s security measures were inadequate, as the company admitted personal data was stolen—not merely accessed. The incident follows a trend of escalating cyberattacks on the gaming sector, with prior high-profile cases like Caesars Entertainment (paid $15M ransom) and MGM Resorts (lost ~$100M in disruptions). Boyd is cooperating with cybersecurity experts and law enforcement, but the breach underscores growing legal, financial, and reputational risks tied to data exposure in the industry.

Boyd Gaming Corporation, a major U.S. gambling and hospitality company operating 28 casinos and online gaming platforms, suffered a data breach in early September 2025. An unauthorized third party gained access to its internal IT systems between September 5–7, 2025, exfiltrating sensitive personally identifiable information (PII) of customers. The compromised data included names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers (e.g., passports), and dates of birth. The breach impacted thousands of individuals across multiple states, with 4,300 affected in Texas alone. Boyd Gaming notified regulators, attorney general offices, and the U.S. Securities and Exchange Commission (SEC). While the company offered two years of free credit monitoring and identity protection services, the exposure of high-risk PII (e.g., SSNs, driver’s licenses) poses significant long-term risks, including identity theft, financial fraud, and unauthorized account access. Legal firms are investigating potential class-action lawsuits, as affected individuals may be entitled to compensation for the unauthorized exposure of their sensitive data, even if no immediate fraud has occurred. The breach underscores vulnerabilities in Boyd Gaming’s cybersecurity defenses, particularly given the targeted extraction of highly sensitive customer records by external threat actors.

Boyd Gaming Corp., a major Las Vegas-based casino operator with 11 properties in the Las Vegas Valley and additional locations across 10 U.S. states, suffered a cyberattack in early September 2023 (reportedly between September 5–7). The breach involved unauthorized access and exfiltration of employee data and records tied to a limited number of other individuals, including customers and former employees. The company delayed notifying victims, with lawsuits alleging negligence in safeguarding personal information and failing to disclose the breach promptly. Multiple class-action lawsuits—filed by employees, ex-employees, and customers from Nevada, Texas, Louisiana, and Ohio—accuse Boyd of breach of implied contract, negligence, invasion of privacy, and unjust enrichment. The SEC filing confirmed data theft, but Boyd has not clarified whether ransomware was involved or if a ransom was paid. The incident impacts thousands of individuals, raising concerns over financial fraud, identity theft, and reputational damage to the company. Plaintiffs claim Boyd intentionally obscured the breach’s scope, including how hackers accessed sensitive data and the duration of unauthorized access.

Boyd Gaming, a major casino entertainment company, suffered a cyber breach where an unauthorized third party infiltrated its IT systems and exfiltrated sensitive data belonging to current/former employees and a limited number of customers. The breach has triggered five class-action lawsuits, with plaintiffs—including employees and customers—alleging negligence in cybersecurity safeguards. The stolen data reportedly includes personal information, leading to increased spam calls and phishing attempts for affected individuals. While Boyd Gaming confirmed the incident in an SEC filing and claimed casino operations remained unaffected, it has not disclosed the exact timeline, scope of stolen data, or whether a ransom was paid. The company is relying on cybersecurity insurance to cover investigation costs, lawsuits, and potential regulatory fines. The breach aligns with a broader trend of cyberattacks targeting Nevada’s gaming industry, following similar incidents at MGM Resorts and Caesars Entertainment in 2023.