RCI Internet Services, Inc.
bd_84021bb308396ab6 · schema v1 · pii pii-v1
Full breach record for RCI Internet Services, Inc. →2 incidents on fileRCI Internet Services, Inc., a subsidiary of RCI Hospitality Holdings, Inc., disclosed a cybersecurity incident that started March 19, 2026 and was discovered March 23, 2026. Its investigation found that a potential insecure direct object reference vulnerability was present on the company's internet information services (IIS) web server. The company believes independent contractors' personal information, including names, contact details, dates of birth, Social Security numbers, and driver's license numbers, was accessed without authorization. The company engaged third-party cybersecurity firms, enhanced security posture by expanding multifactor authentication, and disabled external access to the IIS. No customer information or financial systems were accessed.
J jump to incidentP pin to compareR raw source
Incident timeline
Mar 19, 2026
Begins
Mar 23, 2026
Discovered
Apr 13, 2026
Filed
vs. sector median
16 wks faster
Linked disclosures
Why this link?Regulatory filings (7) · sorted by filing gap
- Indiana State AGbd_a70b8f9e2881284f2026-05-28 · +45dCandidate
- California State AGbd_5a66b0e3099e927c2026-05-29 · +46dVerified
- New Hampshire State AGbd_a36612655039e10f2026-06-01 · +49dVerified
- Illinois State AGbd_dc1d8fc53c8149002026-06-01 · +49dVerified
Show 3 more filings ↓Show fewer ↑up to 52d gap
- Texas State AGbd_e1970dead6647d022026-06-01 · +49dVerified by operator
- Maine State AGbd_de36ff1d1abec9fb2026-06-02 · +50dVerified by operator
- Massachusetts State AGbd_1c6361a1686369b82026-06-04 · +52dVerified
Filing propagation · 8 filings · 7 states
View merged incident ↗Pattern: first filing Apr 13, last Jun 4 (MA) — a 52-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.