2026 RCI Hospitality Holdings — IDOR on IIS server; 40K contractors (SSNs, DL numbers)
Data compromised
Independent contractor names, contact info, DOB, SSNs, and driver’s license numbers
Technical writeup
RCI Hospitality Holdings told Maine regulators in June 2026 that more than 40,000 individuals were affected by a data breach at subsidiary RCI Internet Services. The company disclosed to the SEC in April 2026 that an IDOR vulnerability on a March 23 IIS web server allowed unauthorized access to independent-contractor files containing names, contact information, dates of birth, Social Security numbers, and driver’s license numbers. File review completed May 13; FBI notified.
Root cause
Insecure direct object reference (IDOR) on RCI Internet Services IIS web server