2026 RCI Internet Services (RCI Hospitality) — IDOR breach; 40K contractors
Data compromised
Not specified in AG list export; see organization sample notification
Technical writeup
RCI Internet Services, a subsidiary of RCI Hospitality Holdings, disclosed a March 2026 IDOR vulnerability on an IIS web server exposing independent-contractor data. Maine AG filing in June 2026 confirmed more than 40,000 affected individuals with names, contact information, DOB, SSNs, and driver’s license numbers. See also canonical row rci-hospitality-holdings-idor2026.
Root cause
Disclosed via California breach notification law (CA Civil Code §1798.82)