Bonanza Casino

Medusa, a ransomware group tracked by federal agencies, has claimed responsibility for a cyberattack on Bonanza Casino, a family-owned gaming venue in Reno, Nevada that has operated since 1973. The breach exposed roughly 26,899 records containing personal information, including more than 5,700 Social Security numbers. Details about the full scope of the incident remain limited.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

Breach Timeline

March 17, 2026: Legal investigators at Cole & Van Note, citing the Nebraska Attorney General's data breach portal, report that Bonanza Casino began notifying individuals that their data was accessed on or around this date.

March 18, 2026: Breachsense, a ransomware tracking service, records Medusa listing Bonanza Casino on its leak site. Cole & Van Note's reporting also indicates Bonanza Casino began sending breach notifications on this date.

What Information Was Compromised?

Our analysis found the following data types in this breach: names (26,899 records), street addresses (12,121), email addresses (10,163), phone numbers (3,404), Social Security numbers (5,741), and dates of birth (2,438). The figures come from the indexed dataset of about 26,899 rows.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

Social Security numbers and dates of birth are the most sensitive items in this dataset. Combined with a full name and address, they give criminals enough material for identity theft, fraudulent loan and credit applications, and tax-related fraud, where a thief files a return in someone else's name to claim a refund.

Email addresses and phone numbers enable targeted phishing. Attackers who know a victim's name and that they visited a casino can craft convincing messages about account issues, suspicious charges, or compensation offers. These messages often aim to harvest passwords or payment details.

Street addresses also carry a physical risk, since they confirm where a person lives.

What Is Bonanza Casino Doing in Response?

According to reporting by Cole & Van Note, which cites the Nebraska Attorney General's data breach portal, Bonanza Casino began notifying affected individuals on March 18, 2026. Beyond the notification effort, the firm's investigators did not publish details about credit monitoring offers, remediation steps, or the cause of the intrusion as of September 25, 2026. The law firm has said it is investigating potential class action claims related to the breach.

What Should You Do If You Were Affected?

If you received a notice from Bonanza Casino, or if you believe your data may be involved, take these steps:

Place a fraud alert or credit freeze. Contact one of the three credit bureaus (Equifax, Experian, or TransUnion); placing a fraud alert with one alerts the others. A credit freeze blocks most new credit applications in your name.

Request free credit reports at AnnualCreditReport.com and review them for accounts you did not open.

Watch your financial statements for unfamiliar charges, and review any explanation of benefits from health insurers for services you did not receive.

Get an IRS Identity Protection PIN if your Social Security number was exposed. This prevents someone else from filing a tax return in your name.

Be skeptical of unexpected emails, calls, or texts referencing Bonanza Casino. Do not click links or share passwords or payment information. Verify claims by contacting the casino through its official website.

Use unique passwords and enable two-factor authentication on email and financial accounts.