Brightstar Global Solutions Corporation Data Breach 2025: 103,879 Affected (Including Health Data) · Now Brightstar Lottery PLC · RI Health Plan

Brightstar Global Solutions Corporation, a Rhode Island lottery-technology operator that until recently was part of International Game Technology (IGT), filed an HHS OCR breach on October 3, 2025 reporting 103,879 affected individuals. The OCR portal classifies the entity as a Health Plan and the incident as a Hacking/IT Incident at Network Server — consistent with employee, retiree, or participant health-plan records being among the data sets stored on the compromised internal systems. Unauthorized access was actually discovered eleven months earlier, on November 17, 2024, and the data review did not complete until August 21, 2025.

Timeline

• November 17, 2024 — Brightstar and IGT discover that an unauthorized third party accessed certain internal corporate systems.
• August 21, 2025 — Forensic review of impacted data completes, identifying affected individuals and data elements.
• October 3, 2025 — Notification letters begin mailing. Brightstar files with HHS OCR (103,879 affected) and with the Attorneys General of California, Maine, Massachusetts, Montana, Oregon, Washington, New Hampshire, Iowa, Nebraska, South Carolina, and Texas. Rhode Island AG receives notice the same week; the Rhode Island count is 6,354 residents. Other confirmed resident counts: Washington (1,796), Massachusetts (1,483), Montana (208), Maine (116).
• October 6, 2025 — Vermont Attorney General receives notice. Multiple plaintiffs’ firms announce investigations the same week: Strauss Borrelli, Lynch Carpenter, Murphy Law Firm, Edelson Lechtzin, Schubert Jonckheer & Kolbe, Cafferty Clobes Meriwether & Sprengel, Federman & Sherwood, Pittman Dutton Hellums Bradley & Mann, and Almeida Law Group.

The roughly eleven-month gap between discovery and individual notification is a recurring complaint in the plaintiffs’ bar’s public investigation notices and is likely to feature in any class complaint.

The company has since rebranded: Brightstar Global Solutions Corporation is now publicly known as Brightstar Lottery PLC, a foreign private issuer traded on U.S. markets and registered with the SEC (Commission File No. 001-36906, formerly traded under International Game Technology PLC). The July 2025 corporate split separated Brightstar Lottery (lottery technology) from IGT (casino gaming and FinTech).

What was exposed

Per the state Attorney General notice letters, the data elements involved may include:

• Full name and contact information
• Date of birth
• Government identification documents or numbers, such as driver’s license
• Social Security number or other tax identifier
• Financial account information
• Health data
• Other information collected in connection with the individual’s relationship with Brightstar or a lottery or gaming venue supported by Brightstar

The presence of health data in the disclosed categories — combined with the OCR filing under the Health Plan classification — is what places this incident on this page. The most likely health-data subset is employee or retiree group-health-plan information rather than patient records.

What the plan is offering

Brightstar engaged Kroll to provide identity-monitoring services at no cost for 24 months, including credit monitoring, fraud consultation, and identity-theft restoration. Affected individuals can enroll at https://enroll.krollmonitoring.com using the enrollment code printed in their individual notification letter. The enrollment deadline is stated in each individual letter. A dedicated assistance line is available at (866) 819-2404, Monday through Friday.

Class-action posture

As of early June 2026, no consolidated class-action complaint has been confirmed on the public dockets in our review, but at least nine plaintiffs’ firms have publicly opened investigations within days of the October 3 notice: Strauss Borrelli PLLC, Lynch Carpenter LLP, Murphy Law Firm, Edelson Lechtzin LLP, Schubert Jonckheer & Kolbe LLP, Cafferty Clobes Meriwether & Sprengel LLP, Federman & Sherwood, Pittman Dutton Hellums Bradley & Mann P.C., and Almeida Law Group. ClassAction.org has noted that its investigation into this matter is now complete — suggesting attorneys coordinating through that aggregator have moved toward a filing decision. The recurring themes in firm announcements are (1) the eleven-month delay between discovery and notification, (2) the sensitivity of the data set (SSN plus financial plus health), and (3) the size of the affected population. District of Rhode Island and possibly the District of Nevada (IGT’s headquarters at the time of the incident) are the venues to watch for any consolidated complaint.

What to do

1. Watch your mail for a notification letter from Brightstar Global Solutions Corporation. The letter carries your personal enrollment code for Kroll identity monitoring.
2. Enroll in the Kroll monitoring before the deadline in your letter. Twenty-four months of credit monitoring plus identity-theft restoration is materially better than nothing, especially given that SSN was in the data set.
3. Place free credit freezes at Equifax, Experian, and TransUnion. This is the single highest-leverage step against new-account fraud and it stays in place after the Kroll coverage expires.
4. Pull free credit reports at annualcreditreport.com and review for unfamiliar accounts.
5. If you are a Rhode Island lottery retailer, vendor, employee, or contractor of Brightstar/IGT and you have not received a letter by mid-2026, contact the Brightstar assistance line at (866) 819-2404 to confirm whether you were in scope.
6. Decide on class-action participation when a complaint is filed and a class notice issues. Until then, retaining your notification letter and the postmarked envelope preserves your standing.
7. Stop the ongoing flow of your health plan data. HealthConsent files HIPAA restriction requests so the health and benefits data exposed in this breach is not continuously re-shared across insurance networks and third-party data brokers.

Sources

• HHS Office for Civil Rights Breach Portal — federal regulatory record (103,879 affected, Hacking/IT Incident at Network Server).
• Massachusetts AG — Brightstar consumer notice (2025-1706) — the actual notification letter text and Kroll enrollment instructions.
• Vermont Attorney General — Brightstar data breach notice — Oct 3, 2025 consumer notice filing.
• Rhode Island Attorney General Data Breach Notifications — state-level filings index.
• Turnto10 (WJAR) — Rhode Island count of 6,354 affected residents and IGT relationship context.
• Boston Globe — regional news coverage.
• ClassAction.org — 103,879 affected count, investigation status.
• Strauss Borrelli PLLC — plaintiff-firm investigation announcement.
• PR Newswire (Schubert Jonckheer & Kolbe) — privacy alert.
• Lynch Carpenter LLP (GlobeNewswire) — investigation announcement.
• Federman & Sherwood — investigation announcement, confirmed Kroll 24-month monitoring offer.
• Pittman Dutton Hellums Bradley & Mann P.C. — investigation announcement confirming data elements including health and medical data.
• ClaimDepot — state-by-state resident counts; list of 14 AG filings (CA, IA, ME, MA OCABR, MT, NE, NH, OR, RI, SC, TX, VT, WA, HHS).
• Notice of Data Breach — full letter PDF (ClassAction.org mirror) — verbatim notification letter text confirming data categories and Kroll enrollment instructions.
• SEC Form 6-K — Brightstar Lottery PLC (July 2025) — confirms legal entity name change to Brightstar Lottery PLC and corporate separation from IGT post-July 2025 spin-off.