BreachPublished 5 Jun 2026

Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals

Source SecurityWeek

Description

The company detected a network intrusion in March and an investigation showed that some files were stolen during the attack. The post Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals appeared first on SecurityWeek .

Impact

The breach exposed sensitive personal information of approximately 40,000 individuals, including highly sensitive data such as Social Security numbers and driver’s license numbers. This exposure increases the risk of identity theft and fraud for affected individuals. The incident also impacts RCI Hospitality Holdings' reputation and may result in regulatory scrutiny. There is no indication of ransomware involvement or further exploitation beyond the data theft. The FBI is involved in the investigation.

Defensive guidance

RCI Hospitality Holdings identified and disclosed the IDOR vulnerability that led to the breach. Organizations should review and secure web application endpoints to prevent unauthorized data access. Since this is not a cloud service, remediation responsibility lies with RCI. Affected individuals have been notified. The FBI is investigating, and RCI is cooperating. Patch status is not explicitly confirmed; check with RCI or relevant advisories for updates.

Summary

In March 2026, RCI Hospitality Holdings discovered an insecure direct object reference (IDOR) vulnerability on an IIS web server operated by its RCI Internet Services subsidiary. This vulnerability enabled attackers to access personal information by altering URL parameters to retrieve data belonging to other users. The breach resulted in the theft of files containing sensitive personal information of roughly 40,000 individuals, including independent contractors. The compromised data includes personally identifiable information such as names, contact information, dates of birth, Social Security numbers, and driver’s license numbers. The incident was reported to authorities, including the FBI, and the company is cooperating with ongoing investigations. No details about the attacker or exploitation methods beyond the IDOR vulnerability have been disclosed.

References

securityweek.com/nightclub-giant-rci-says-data-breach-affects-40000-individuals/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Jun 2026, 07:33 UTC

References

Community reviews