HackingRetail & ConsumerRetailVulnerability ExploitCapture Stored DataCLOPN-DayData ExfiltratedCustomer Data InvolvedTargetedGovernment IDIdentity (basic)MediumContained

RCI, LLC

bd_0c2271b8e6a81370 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 19, 2024

Filed

Mar 1, 2024

To disclose

6 weeks

Affected

10state residents only

Linked

8 filings

Confidence

66%

Full breach record for RCI, LLC →2 incidents on file

RCI, LLC notified the NH Attorney General of a security incident involving MOVEit Transfer. The CLOP group exploited a vulnerability in the software between May 31 and June 1, 2023, to access files. RCI determined on January 19, 2024, that government ID numbers of 10 NH residents were compromised. RCI mailed notifications on March 1, 2024, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d6 weeks discovery → filing

Incident timeline

undetected · 233 days

discovery → filing · 6 weeks / 42 days

May 31, 2023

Begins

Jan 19, 2024

Discovered

Mar 1, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 8 about the same incident.View merged incident

A leak claim by cl0p about this victim predates this filing by 228 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_6bda4ba0f18ab55d2023-07-17 · +228dVerified by operator

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_39f6f190b209c3de2024-03-01Verified
Montana State AGCLOPbd_49c3ccfedb62aae62024-03-01Candidate
California State AGCLOPbd_b1f0369446f8ee142024-03-01Verified
Maine State AGbd_d04cbfaf4ecd86082024-03-01Verified

Show 2 more filings ↓up to 170d gap

Vermont State AGCLOPbd_d7c523ed63f056b52024-03-01Verified
Indiana State AGbd_a795a1402f57de072023-09-13 · +170dVerified by operator

Name: RCI, LLC
norm: rci
Domain: rci.com

Name: RCI, LLC
norm: rci
Domain: rci.com
Industry: Retail & Consumerllm

Discovered: Jan 19, 2024
Breach occurred: May 31, 2023 – Jun 1, 2023
Undetected for: 233 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 1, 2024
Affected individuals: 10state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access· CLOP
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1119 Automated Collection
Threat actor: CLOPExternalFinancial
Regulator citations: Notified Attorney General John Formella
Initial access: exploit_public_facing

During the incident: Engaged a third-party forensic firm
Conducted a careful review of the files viewed and taken by CLOP
Mailed notification letters via First Class mail to the involved New Hampshire residents
Offered the residents a complimentary membership to credit monitoring and identity theft protection services
Established a toll-free call center for individuals to obtain more information
Changes made: Implemented additional access controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGSep 13 · first

Massachusetts State AG+170d

Montana State AG+170d

California State AG+170d

Maine State AG+170d

Vermont State AG+170d

New Hampshire State AG+170d · this page

Pattern: first filing Sep 13 (IN), last Mar 1 (NH) — a 170-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rci-20240301.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 1, 2024
Raw hash: afc618591860afa54d05e62923148a647660e05cea8e276326234c3b26552c6e

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityRCI, LLC

Victim entityRCI, LLC

Incidentdiscovered Jan 19, 2024

Stated responseEngaged a third-party forensic firm

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov