Scorned racino developer Rick Heidner sues Illinois Gaming Board over data breach

Denied a bid to open a suburban racetrack-casino and fighting state regulators’ effort to revoke his video gambling license, suburban developer Rick Heidner says an Illinois Gaming Board employee leaked mountains of his sensitive information to three federal agencies in a data breach revealed last month.

Now Heidner and his company Gold Rush Amusements are taking the Gaming Board to court with a $4 million lawsuit filed Tuesday, claiming the unnamed employee served up personal and financial information “intentionally and illegally” — and that the board only made things worse for Heidner with “unfair and improper actions” that hit his reputation and bottom line in the fallout of his failed Tinley Park racino deal.

Citing state privacy laws, Gaming Board administrator Marcus Fruchter notified state legislative leaders of the data breach in a Jan. 10 letter saying they’d discovered a week earlier that “an IGB employee may have improperly accessed confidential information on IGB licensees and applicants and disclosed this information without authorization or justification to three federal government entities.”

Fruchter called it “an isolated incident involving one employee who acted alone and outside the scope of their duties,” but didn’t say whose information was released or which federal agencies received it.

Heidner says it wasn’t until Jan. 31 that the Gaming Board told him it was his information that had been improperly accessed, including troves of sensitive financial records and personal information not only on Heidner and Gold Rush, but also on his wife, two of his children and dozens of business partners from among the 500-plus establishments statewide that house Heidner’s slot machines.

“Despite requiring licensees and associated individuals to hand over a veritable treasure trove of their most sensitive data, the evidence will show that the IGB’s approach to protecting Mr. Heidner’s data has been careless and cavalier, at best,” attorneys write in Heidner’s suit filed in the Illinois Court of Claims.

Heidner says the leaks started in October, the day after a Chicago Tribune report detailed his business ties to a banking family with mob connections. His name also surfaced in search warrants released that week revealing federal agents were interested in items related to Heidner and his gambling company last summer when they raided the offices of former state Sen. Martin Sandoval, who has since pleaded guilty to a federal bribery charge.

That prompted Gov. J.B. Pritzker to pull the plug on a racino plan Heidner had forged with Hawthorne Race Course president Tim Carey. They had appeared on path to state approval before Pritzker’s office refused to sell state land for the project in light of the revelations.

Victor Hilitski / Sun-Times

But Heidner maintains the Gaming Board knew about all of his business connections, and the employee “made these unauthorized disclosures to fuel ― or at least in response to ― negative media coverage the IGB helped generate against Mr. Heidner and Gold Rush.”

The employee is not named in the suit, which says the person “was not assigned to any Gold Rush-related investigative matter” and did not have “any official purpose” for accessing the data. In his letter, Fruchter told legislative leaders the worker “has been placed on administrative leave” pending an internal investigation.

A Gaming Board spokesman says the agency does not comment on pending litigation and declined to comment on the breach.

This latest legal volley from Heidner comes after the Gaming Board filed a disciplinary action against him in December seeking to revoke his gambling license for allegedly offering up a $5 million “illegal inducement” to the owner of a gambling parlor chain that planned to remove Heidner’s machines. Heidner’s team says it’s all part of a “smear campaign” orchestrated by a competitor with whom he’s also wrangling in civil court.

In the Gaming Board suit, Heidner and Gold Rush are seeking damages totaling $4 million, alleging negligence and breach of fiduciary duty.