HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

RCI Internet Services, Inc.

bd_a36612655039e10f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 23, 2026

Filed

Jun 1, 2026

To disclose

10 weeks

Affected

46state residents only

Linked

8 filings

Confidence

66%

Full breach record for RCI Internet Services, Inc. →2 incidents on file

RCI Internet Services, Inc. notified the New Hampshire Attorney General of a data event affecting approximately 46 NH residents. Unauthorized access occurred on March 19, 2026, exposing names, SSNs, driver's license numbers, and passport numbers. RCI engaged cybersecurity experts, notified federal law enforcement, and provided 12 months of credit monitoring via IDX.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 10 weeks / 70 days

Mar 19, 2026

Begins

Mar 23, 2026

Discovered

Jun 1, 2026

Filed

vs. sector median

9 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Illinois State AGbd_dc1d8fc53c8149002026-06-01Verified
Texas State AGbd_e1970dead6647d022026-06-01Verified by operator
Maine State AGbd_de36ff1d1abec9fb2026-06-02 · +1dVerified by operator
Massachusetts State AGbd_1c6361a1686369b82026-06-04 · +3dVerified

Show 3 more filings ↓up to 49d gap

California State AGbd_5a66b0e3099e927c2026-05-29 · +3dVerified
Indiana State AGbd_a70b8f9e2881284f2026-05-28 · +4dCandidate
SEC 8-Kbd_84021bb308396ab62026-04-13 · +49dVerified

Name: RCI, LLC
norm: rci
Domain: rci.com

Name: RCI Internet Services, Inc.
norm: rci internet
Industry: Technologyllm

Discovered: Mar 23, 2026
Breach occurred: Mar 19, 2026
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 28, 2026
Affected individuals: 46state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified federal law enforcement regarding the event
Initial access: exploit_public_facing

During the incident: Engaged independent cybersecurity experts to assist
Notified federal law enforcement regarding the event
Provided access to credit monitoring services for 12 months, through IDX, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and Trans Union
Changes made: Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

SEC 8-KApr 13 · first

Indiana State AG+45d

California State AG+46d

Illinois State AG+49d

Texas State AG+49d

New Hampshire State AG+49d · this page

Maine State AG+50d

Massachusetts State AG+52d

Pattern: first filing Apr 13, last Jun 4 (MA) — a 52-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rci-internet-services-20260601.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 1, 2026
Raw hash: 4e5dccc8d0ed3715a45c92162fd4d22cff5a1c75444e7861446207d60bde5c2a

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityRCI, LLC

Victim entityRCI Internet Services, Inc.

Incidentdiscovered Mar 23, 2026

Stated responseEngaged independent cybersecurity experts to assist

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov