RCI Hospitality Says Data Breach Affects More Than 40,000 People
Summary
RCI Hospitality says an IDOR vulnerability in an IIS web server allowed unauthorized access to personal information. The company told Maine authorities that more than 40,000 people are affected; the attacker is unknown.
Key points
- RCI Hospitality said its subsidiary discovered an IDOR vulnerability on March 23 in an IIS web server, allowing unauthorized access to personal information.
- The company initially reported exposure of independent contractors’ names, contact information, dates of birth, Social Security numbers and driver’s license numbers.
- Notification letters say the review of affected files was completed on May 13.
- RCI told the Maine Attorney General that more than 40,000 individuals are affected.
- The FBI has been informed, and RCI says it will cooperate with any resulting investigation.
- The article does not identify the attacker; no known ransomware group has claimed responsibility.
Article Details
- Victim Organization
- RCI Hospitality Holdings
- Incident Type
- Data breach involving unauthorized access through an insecure direct object reference (IDOR) vulnerability in an IIS web server
- Data Types Exposed
- Names
- Contact information
- Dates of birth
- Social Security numbers
- Driver's license numbers
- Affected Records
- More than 40,000 individuals
- Operational Impact
- Unknown
- Ransom Or Extortion
- No known ransomware group appears to have taken credit for the attack; no further extortion activity is reported.
- Claim Status
- confirmed