One of Las Vegas’ biggest casino operators is now facing a sweeping federal class action after hackers claimed they made off with a massive trove of customer data.
In a lawsuit filed in U.S. District Court in Las Vegas and reviewed by ReadWrite, Richard Reed accuses Wynn Resorts Limited of failing to properly secure sensitive personal information. The complaint is based on a cyberattack that allegedly exposed names and Social Security numbers, putting customers at risk of identity theft for years to come.
According to the filing, “On February 20, 2026, the notorious hacking group ShinyHunters announced it had stolen over 800,000 records from Defendant containing the personal information of Plaintiff and Class Members.” ShinyHunters has been linked to a string of high-profile data breaches and online leaks, according to cybersecurity researchers.
The lawsuit says the stolen files included names and Social Security numbers and claims that this information was stored without encryption. It alleges that “Hackers targeted and obtained Plaintiff’s and Class Members’ Private Information because of its value in exploiting and stealing the identities of Plaintiff and Class Members.”
Reed, who lives in California, is seeking to represent customers nationwide whose data was allegedly compromised. The complaint argues that Wynn, headquartered on the Las Vegas Strip, collected and stored highly sensitive information as part of its normal business operations but failed to protect it.
The filing adds: “Defendant failed to adequately protect Plaintiff’s and Class Members’ Private Information—and failed to even encrypt or redact this highly sensitive information.” Reed contends the company had a duty to safeguard that data and did not live up to that responsibility.
Wynn Resorts questioned over data breach notice and response in class action filing
Beyond the alleged breach itself, the lawsuit takes aim at how Wynn handled the aftermath. Reed claims the company did not provide customers with a full accounting of what happened or how it plans to prevent a repeat.
Specifically, the complaint alleges that Wynn’s notice left out critical information, including “the identity of the cybercriminals who perpetrated this Data Breach, the details of the root cause of the Data Breach, the vulnerabilities exploited, and the remedial measures undertaken to ensure such a breach does not occur again.”
The company did offer 24 months of identity monitoring services, according to the filing. But the lawsuit argues that two years of monitoring is not enough when Social Security numbers are involved, since that type of information can be misused long after the monitoring period ends.
Reed says he and other proposed class members have already spent time checking financial accounts and credit reports and will likely need to remain vigilant for years.
He is asking the court to certify a nationwide class of all U.S. residents whose private information was accessed or acquired in the breach. The lawsuit seeks damages, injunctive relief and changes to Wynn’s data security practices.
The case lands at a time when Wynn Resorts has been touting strong financial performance. In its fourth-quarter and year-end 2025 earnings report, the company pointed out revenue growth and solid operating results across its properties.
However, it’s not the first time Wynn has faced regulatory scrutiny, after it received a $5.5 million fine from Nevada regulators in May 2025 related to anti-money laundering compliance issues at its Las Vegas resort.
ReadWrite has reached out to Wynn Resorts Limited for comment.
Featured image: Alexander Migl via WikiCommons 4.0 license
