Old National Events Plaza Data Breach — Class Action Review

Old National Events Plaza operates as a premier multi-purpose entertainment, convention, and meeting facility located in Evansville, Indiana. As a prominent regional hub hosting large-scale trade shows, corporate conventions, weddings, and public performances, the organization acts as a central repository for vast amounts of sensitive personal, financial, and operational data. To facilitate ticketing, event registration, vendor contracting, and payroll processing, Old National Events Plaza routinely collects and maintains detailed personally identifiable information (PII) from thousands of patrons, event organizers, artists, and employees, creating an attractive target for malicious cyber actors seeking to exploit stored information.

In 2025, Old National Events Plaza reported a significant security incident to the Indiana Attorney General, highlighting vulnerabilities within its digital infrastructure. While the exact vector of the breach remains under investigation, incidents impacting large public assembly venues and hospitality-adjacent organizations typically involve sophisticated cyberattacks such as unauthorized database access, ransomware deployment, or third-party vendor compromises. Because ticketing platforms, guest management systems, and administrative networks often integrate multiple third-party applications, a single point of failure can allow unauthorized parties to infiltrate internal servers and exfiltrate sensitive files before detection occurs.

The data compromised in this breach likely encompasses a wide array of sensitive information, each carrying distinct and severe risks for affected individuals. Exposure of names, dates of birth, and Social Security numbers creates an immediate and long-term risk of identity theft, enabling cybercriminals to open fraudulent credit lines, secure unauthorized loans, or commit tax fraud in the victim's name. Furthermore, the potential leakage of financial account details, payment card information, and transaction histories exposes victims to direct financial loss and account takeover schemes. For employees and contractors whose payroll and tax records may have been stored on the plaza's network, the compromise of wage details and home addresses compounds their vulnerability to targeted phishing and financial fraud.

Operating as a custodian of consumer and employee data, Old National Events Plaza was legally obligated under Indiana state data protection statutes and common law negligence principles to implement and maintain reasonable security procedures to safeguard private information. These legal frameworks require organizations to utilize robust administrative, technical, and physical safeguards—including regular network monitoring, encryption, and secure access controls—to prevent unauthorized disclosures. The occurrence of a successful breach strongly suggests a failure in these security protocols, raising serious questions regarding whether the organization met its legal duties to protect the private data entrusted to its care.

Receiving a formal data breach notification letter from Old National Events Plaza serves as legal confirmation that your private records were exposed due to corporate negligence, establishing the requisite legal standing to participate in a class action lawsuit. Under modern data breach jurisprudence, affected individuals do not need to wait until they experience actual financial fraud or out-of-pocket loss to seek legal recourse; the mere increased risk of future identity theft and the time spent mitigating it constitutes a compensable injury. Our law firm is actively investigating this breach on a contingency fee basis, meaning affected individuals pay absolutely no out-of-pocket costs or legal fees unless we successfully recover compensation on your behalf.