In March 2026, RCI Hospitality Holdings discovered an insecure direct object reference (IDOR) vulnerability on an IIS web server operated by its RCI Internet Services subsidiary. This vulnerability enabled attackers to access personal information by altering URL parameters to retrieve data belonging to other users. The breach resulted in the theft of files containing sensitive personal information of roughly 40,000 individuals, including independent contractors. The compromised data includes personally identifiable information such as names, contact information, dates of birth, Social Security numbers, and driver’s license numbers. The incident was reported to authorities, including the FBI, and the company is cooperating with ongoing investigations. No details about the attacker or exploitation methods beyond the IDOR vulnerability have been disclosed.

The breach exposed sensitive personal information of approximately 40,000 individuals, including highly sensitive data such as Social Security numbers and driver’s license numbers. This exposure increases the risk of identity theft and fraud for affected individuals. The incident also impacts RCI Hospitality Holdings' reputation and may result in regulatory scrutiny. There is no indication of ransomware involvement or further exploitation beyond the data theft. The FBI is involved in the investigation.

RCI Hospitality Holdings identified and disclosed the IDOR vulnerability that led to the breach. While no specific patch details are provided, remediation of IDOR vulnerabilities typically involves implementing proper access controls and authorization checks on web server resources. Organizations should review and secure web application endpoints to prevent unauthorized data access. Since this is not a cloud service, remediation responsibility lies with RCI. Affected individuals have been notified. The FBI is investigating, and RCI is cooperating. Patch status is not explicitly confirmed; check with RCI or relevant advisories for updates.