Just a little insight. This happens far more then you will ever know.
A while back a similar event like this happened BUT one of the casinos effected decided to sue. A significant sum, 8 figures. Yes, sue the data thief.
Name,, address, username, credit card numbers, deposit and withdrawl history, everything on record was stolen and sold.
I was brought in and 'certified' by the court as an expert witness in the online gaming field
Over 6 hours of hostile depostion. Not fun.

Even
Long story short there was an out of court settlement.
The 'surprise' was in how they got the data. They got it from a data center tech. You know, one of all those underpaid even remotely located in an impoverished third world country people that have root access to most every server in the dc. The guy you call when your site is down. Yup them.
Very easy to burn a cd or now a flash drive with all the data with no one ever knowing and sell it off. Well one of them had a friend who was one of those 'master affiliates' and they worked out a deal for a % of various gaming sites data to be slowly copied and sold off. Most in 50-100K lists.
No data is safe when the barn is open. Someday we will see bonded data centers but not until millions of peoples information is stolen.