A $50 million national privacy breach class action lawsuit is being planned against Ontario’s Casino Rama after it was targeted in an alleged cyberattack that resulted in the theft of confidential customer information.
The Casino Rama Resort in Rama, Ont., near Orillia, said Thursday it had been hacked and warned customers, vendors and current and former staff to keep an eye on their bank accounts, credit cards and other financial information.
The casino said on its website it became aware of the situation on Nov. 4 after an anonymous hacker reportedly stole confidential employee information from 2004 to 2016 — such as performance reviews, payroll data, terminations, social insurance numbers and dates of birth.
Casino Rama also said the alleged hacker claimed to have stolen other confidential information dating back to 2007, including IT documents, hotel and casino financial reports, security incident reports, emails, customer credit inquiries, collection and debt information and vendor information.
Ontario Provincial Police (OPP), Royal Canadian Mounted Police (RCMP), the Ontario Lottery and Gaming Corporation (OLG) and the Alcohol and Gaming Commission of Ontario are working with the casino to investigate the incident and have alerted the Privacy Commissioner of Canada and the Information and Privacy Commissioner of Ontario.
Toronto-based law firms Charney Lawyers PC and Sutts, Strosberg LLP said the national privacy breach class action was in response to the hack and is being brought forth on behalf of employees, customers, and vendors of the resort whose information was compromised.
The statement of claim would be filed in Superior Court on Monday given the Remembrance Day holiday on Friday, said Ted Charney, one of the lawyers involved.
The proposed plaintiffs in the lawsuit are customers who gave Casino Rama their confidential information with the understanding that it would be protected.
“This is a massive privacy breach,” Sutts, Strosberg LLP’s David Robbins said in a statement.
“We still do not know the whole story but it looks like Casino Rama rolled the dice with employee, customer and vendor data rather than invest in state of the art security measures.”
Customers, employees or vendors of the casino who provided their confidential information to the resort from 2004 on, or who received notice of the privacy breach, are asked to register with the lawsuit online.
OLG said the attack was site-specific, so customers who visited other casinos don’t need to worry.
“We continue to work with the proper authorities on the ongoing investigation and are limited in in how much detail we can provide,” Casino Rama spokeswoman Jenna Hunter said in an emailed statement to Global News.
“We deeply regret this situation and recognize the seriousness of the issue.”
No allegations have been tested in court and it was still much too early for any statement of defence. Any trial, if the proposed action were to be certified, is likely years away.
The resort, which has 2,500 slot machines and more than 110 gaming tables and is operated by Penn National Gaming Inc., said the games themselves weren’t hacked.
“Game performance and setup are independent of other Casino Rama Resort networks,” it said.
Located on Rama First Nation, the casino opened 20 years ago and is Ontario’s only First Nations commercial gaming house.
It bills itself as the “premier entertainment destination” in the province and has featured big name live acts such as The Tragically Hip and Jerry Seinfeld, and shows such as “Dancing with the Stars.”
With files from The Canadian Press