Station Casinos Hacked, History Indicates Ransom Paid

By Scott Roeben, on June 01 2026
5 min read 0 comments
Las Vegas

Station Casinos has officially joined the club nobody wants to join: The Hacked Casinos Club. Which isn’t really a thing, but that is not going to stop us from creating a challenge coin for the organization, give it a minute.

While the hack happened on March 5, 2026, Station Casinos only got around to notifying customers starting May 21, 2026. The prime directive whenever there’s a data breach is to keep the incident as quiet as possible. This one’s been kept so quiet, no local news outlet reported on the hack until we Tweeted about it and shamed them into it. Don’t get us started.

The data breach didn’t result in disruption to the business, which means Station Casinos paid the hacker’s ransom. If you don’t, it can cost $100 million to fix the problem. Just ask MGM Resorts. Long story.

We have no direct information the hacker was a young male, but we also have no direct evidence cats are plotting to murder us all. Some things are just true.

Station Casinos operates Durango Casino, Red Rock Resort, Green Valley Ranch, Palace Station, Sunset Station, Boulder Station, Santa Fe Station, Barley’s Casino & Brewery, The Greens and a handful of Wildfire and Seventy Six taverns.

We first learned of the Station Casinos data breach from a customer notification letter.

The letter contained some pertinent information: “What Happened? On March 5, 2026, we identified suspicious activity associated with our network. As soon as we became aware of the activity, we immediately initiated our incident response protocols, took steps to secure our systems, and engaged cybersecurity experts to assist with the investigation.”

Reactive is the new proactive.

Then we get into the real ugliness: “What Information Was Involved? On April 15, 2026, our investigation determined that some of your personal information may have been accessed by an unauthorized individual, including your name and date of birth, Social Security Number.”

It’s an all-too-common problem, definitely not limited to casinos, but casino companies have been hit across Las Vegas and beyond. In addition to the two most visible hacks of Caesars and MGM Resorts, many others have been hit, paid off the hackers, and their data breaches have never been reported. Public companies have to report their incidents.

Yes, even Wynn’s a member. Trust us, everyone is.

This cybersecurity breach notice was filed with the Maine Attorney General’s Office, which means someone affected by the breach resides in Maine. In the filing, first reported by Cybernews.com, the casino company’s systems were “breached by an external threat actor,” the romantic version of “hacker.”

Public companies are obligated to file a Form 8-K with the SEC when data breaches happen, but we haven’t seen that yet from Station Casinos.

The usual routine is a hacker gains access to a company’s systems using “social engineering.” They’ll get an unsuspecting employee (or employee of a vendor) to give up a password, or get them to click on a link that installs malware.

Station hasn’t given too many details about how this breach happened, but it’s been reported “attackers accessed a single employee’s account and associated files.”

Once the data is stolen, there are threats to sell the data on the dark Web unless a ransom is paid.

If a ransom is paid (not officially recommended by law enforcement), it’s back to business as usual, as appears to be the case at Station Casinos. Insurance covers the ransom, and IT professionals use the breach as a learning moment to tighten the casino’s security practices.

Cybernews shares, “The spokesperson said Station Casinos does not believe that ‘the incident will have a material adverse effect on the company’s financial condition or results of operations.'”

That has ransom written all over it. Not paying a ransom can lead to a complete shitshow. A breach can impact every aspect of a business operation.

This process ensures customer information doesn’t get into the wild. One of the conditions of paying the ransom is the hacker has to prove the data is destroyed and cannot be recovered or sold to someone else. Hackers are honorable in this regard, because if they take a ransom and screw the company over, other companies won’t pay ransoms. It’s a whole thing.

A lot of this was revealed during the Caesars Entertainment hack. The company paid a ransom (after negotiating it down from $30 million to $15 million), but business was not interrupted. At MGM Resorts, the mess continued for months.

Back in the day, breaches weren’t common, and businesses feared their reputations would be ruined if word of a successful cyberattack got out. Now, people pretty much shrug and assume their personal information is out there already, anyway.

Casino companies, especially, rely upon trust, and such data breaches definitely undermine trust. But nobody’s quitting their favorite casino over an incident like this.

Whenever data breaches happen, lawsuits follow. So, Station Casinos is obviously girding for that.

Whatever security measures are in place, hackers are always going to be one step ahead. That’s because companies are populated by humans, the weakest link in any security system. Oh, and hackers are just really good at what they do. They are experts not only at technology, but also human behavior. Humans want to help. They click on links. They aren’t computers.

Casinos are attractive and vulnerable targets, not because they’re bad at computer security, necessarily, but because they are basically banks, hotels, restaurants, loyalty programs, entertainment venues and surveillance operations all in one.

A casino isn’t one system, it’s dozens: hotel management, casino management, player tracking, sportsbooks, mobile apps, Wi-Fi, ATMs, kiosks, point-of-sale, digital room keys, HR, payroll, vendor portals, surveillance, security, marketing databases and third-party booking systems. Hospitality is human-heavy. The more humans, the more vulnerabilities.

So. Many. Holes.

Scammers don’t even need computers at all to “hack” casinos. A con man in Mexico talked a cage manager at Circa into delivering $1.1 million in cash to a mule in Las Vegas. There were four deliveries. The scammer impersonated one of the casino’s owners, Greg Stevens. The cage manager believed she was helping. It remains one of the most bizarre crimes in Vegas history.

Station provides this information for those affected by the security breach: “Visit identitytheft.gov for more information about protecting your identity. For information on Experian IdentityWorks, including instructions on how to activate your complimentary membership, as well as additional steps you can take in response, please see the pages that follow this letter. If you have any additional questions, please call our dedicated assistance line at 888-500-5641, Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time.”

Like everyone, we’re concerned about who has access to our information. We were actually a victim of a Station Casino executive accessing player accounts to steal players club points. No hacker was involved. It was Pat Gordon, Director of Innovation at Station Casinos. We are not making this up. Gordon is no longer with the company.

While we’re never thrilled to hear our data may have been exposed, we also aren’t going to let that spoil our fun. We play at Station Casinos casinos often, and we’ll be damned if we’re going to give up our free rice steamer just because some asshat broke into the company’s computer system.

And by “asshat,” we mean handsome, brilliant and exceptionally gifted computer system vulnerability-detection expert whom we admire, respect and definitely do not wish to anger.