HackingOtherVulnerability ExploitCLOPData ExfiltratedTargetedDelayed DiscoveryIdentity (basic)Government IDMediumContained

RCI, LLC

bd_49c3ccfedb62aae6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 19, 2024

Filed

Mar 1, 2024

To disclose

6 weeks

Affected

2state residents only

Linked

8 filings

Confidence

66%

Full breach record for RCI, LLC →2 incidents on file

RCI, LLC notified Montana residents of a breach involving MOVEit Transfer. The CLOP threat actor exploited a vulnerability between May 31 and June 1, 2023, to exfiltrate files containing names, addresses, and government ID numbers. RCI determined the scope on January 19, 2024, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d6 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 233 days

discovery → filing · 6 weeks / 42 days

May 31, 2023

Begins

Jan 19, 2024

Discovered

Mar 1, 2024

Filed

vs. sector median

2 wks faster

This filing is one of 8 about the same incident.View merged incident

A leak claim by cl0p about this victim predates this filing by 228 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_6bda4ba0f18ab55d2023-07-17 · +228dVerified by operator

Regulatory filings (6) · sorted by filing gap

New Hampshire State AGCLOPbd_0c2271b8e6a813702024-03-01Verified
Massachusetts State AGbd_39f6f190b209c3de2024-03-01Verified
California State AGCLOPbd_b1f0369446f8ee142024-03-01Verified
Maine State AGbd_d04cbfaf4ecd86082024-03-01Verified

Show 2 more filings ↓up to 170d gap

Vermont State AGCLOPbd_d7c523ed63f056b52024-03-01Verified
Indiana State AGbd_a795a1402f57de072023-09-13 · +170dVerified by operator

Name: RCI, LLC
norm: rci
Domain: rci.com

Name: RCI, LLC
norm: rci
Domain: rci.com
Industry: Otherllm

Discovered: Jan 19, 2024
Breach occurred: May 31, 2023 – Jun 1, 2023
Undetected for: 233 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access· CLOP
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: CLOPExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged a third-party forensic firm
Implemented additional access controls
Paid for one year of access to Equifax CompleteTM Premier credit monitoring
Changes made: Implemented additional access controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGSep 13 · first

New Hampshire State AG+170d

Massachusetts State AG+170d

California State AG+170d

Maine State AG+170d

Vermont State AG+170d

Montana State AG+170d · this page

Pattern: first filing Sep 13 (IN), last Mar 1 (MT) — a 170-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1155.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 1, 2024
Raw hash: 9ae9ed8e110130ce1c1ea6d9cc1f6af59333b01448984d6fb6c9d079332bb589

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityRCI, LLC

Victim entityRCI, LLC

Incidentdiscovered Jan 19, 2024

Stated responseEngaged a third-party forensic firm

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancedojmt.gov