Wynn Resorts Targeted by Federal Class-Action Suit in Aftermath of ShinyHunters’ Data Breach

Prominent US casino operator Wynn Resorts Limited is facing a federal class-action lawsuit after the hacking group ShinyHunters claimed to have executed a massive 2025 data breach. 

According to the lawsuit filed against Wynn on Feb. 21 in the US District Court for Nevada, plaintiff Richard Reed alleges that Wynn Resorts’ improper handling of customers’ sensitive personal information led to the September breach. 

The litigation follows a ShinyHunters blog post published on Feb. 20 that announced the theft of over 800,000 Wynn customer records. The stolen data is said to include social security numbers and other personal details, putting those exposed at a higher risk of identity theft for years to come.

As reported by The Register, the hacker group gave Wynn a Feb. 23 deadline to reach out, or it would leak the data. If its threat goes unanswered, ShinyHunters also promised to send “several annoying (digital) problems” Wynn’s way. 

To date, cybersecurity researchers have connected ShinyHunters to a string of recent high-profile online leaks and data breaches.

Suit Claims Wynn Left Sensitive Information at Risk

According to Reed’s filing, Wynn are responsible for protecting customer information.

“On February 20, 2026, the notorious hacking group ShinyHunters announced it had stolen over 800,000 records from Defendant containing the personal information of Plaintiff and Class Members,” the lawsuit reads.

“By obtaining, collecting, using, and deriving a benefit from the Private Information of Plaintiff and Class Members, Defendant assumed legal and equitable duties to those individuals to protect and safeguard that information from unauthorized access and intrusion.”

The complaint further argues that Wynn’s failure to protect customers’ “highly sensitive” personal information by leaving it unencrypted places those affected at a lifetime risk. 

“Defendant failed to adequately protect Plaintiff’s and Class Members’ Private Information—and failed to even encrypt or redact this highly sensitive information. This unencrypted, unredacted Private Information was compromised due to Defendant’s negligent and/or careless acts and omissions and its utter failure to protect Plaintiff’s and Class Members’ sensitive data. Hackers targeted and obtained Plaintiff’s and Class Members’ Private Information because of its value in exploiting and stealing the identities of Plaintiff and Class Members. The present and continuing risk of identity theft and fraud to victims of the Data Breach will remain for their respective lifetimes.”

Plaintiff Says Wynn Disclosure was Lacking 

Beyond the alleged breach, the class action questions how Wynn ultimately notified the affected customers. 

According to the seven-count filing, Wynn’s Notice Letter failed to provide customers with a complete accounting of the incident or plans to prevent future attacks. Specifically, the complaint alleges that Wynn’s notice bypassed critical information, such as the identity of the thieves.

“Omitted from the Notice Letter were the identity of the cybercriminals who perpetrated this Data Breach, the details of the root cause of the Data Breach, the vulnerabilities exploited, and the remedial measures undertaken to ensure such a breach does not occur again. To date, these critical facts have not been explained or clarified to Plaintiff and Class Members, who retain a vested interest in ensuring that their Private Information remains protected.”

As a result, Reed argues that Wynn’s “disclosure” amounts to no “real” disclosure of critical facts with any specificity. Without these details, the ability of those affected to mitigate the breach’s resulting harms is “severely diminished.”

Wynn Response ‘Wholly Inadequate’

Although Wynn provided affected customers 24 months of identity monitoring services, the filing argues that the two years offered are “wholly inadequate,” as class members need to remain vigilant for years.

That offer, Reed states:

“Fails to provide for the fact victims of data breaches and other unauthorized disclosures commonly face multiple years of ongoing identity theft, financial fraud, and it entirely fails to provide sufficient compensation for the unauthorized release and disclosure of Plaintiff and Class Members’ Private Information. Moreover, once this service expires, Plaintiff and Class Members will be forced to pay out of pocket for necessary identity monitoring services.”

As remedy, the lawsuit is asking the court to grant:

• Class certification, appointing Reed and counsel as class representatives
• Equitable relief enjoining Wynn from engaging in the wrongful conduct complained of herein, and from refusing to issue “prompt, complete” disclosures
• Injunctive relief, including but not limited to injunctive and other equitable relief as is necessary to protect the interests of Plaintiff and Class Members
• An award of damages, including actual, nominal, and consequential damages
• An award of attorneys’ fees and costs
• Prejudgment interest on all amounts awarded
• Other and further relief as the Court deems just and proper.

Unfortunately, this isn’t Wynn’s first brush with regulatory oversight. In May 2025, Nevada regulators fined the company $5.5 million over anti-money laundering compliance issues at its Las Vegas resort.

Gambling Insider has emailed Wynn Resorts Limited and the plaintiff and class lawyers for comment.