Open report — full analysis, no account required.
Sign up to generate reports and read filings that aren't on the open list.
Get notified when RICK files again. Create a free account and we'll email you the moment its next filing is analyzed.
Get filing alertsRCI Hospitality discloses data breach exposing contractor SSNs and driver's licenses
Filed April 13, 2026 · Period ending April 7, 2026 · ~1 min read
Key Changes
-
high
Subsidiary RCI Internet Services discovered March 23 that hackers exploited a web server vulnerability starting March 19, accessing personal data of numerous independent contractors including social security numbers, driver's licenses, and contact information.
Item 1.05 view on EDGAR → -
medium
Company remediated the vulnerability by implementing multifactor authentication and disabling external server access; no customer information or financial systems were compromised and stolen data has not been publicly released.
Item 1.05 view on EDGAR → -
medium
Management expects no material impact on business operations but will incur investigation and remediation expenses; comprehensive cybersecurity insurance covers incident response, regulatory action, and legal proceedings subject to deductibles and limits.
Item 1.05 view on EDGAR →
Summary
RCI Hospitality disclosed that its subsidiary RCI Internet Services suffered a four-day cybersecurity breach in mid-March 2026, exposing sensitive personal information of numerous independent contractors. The breach exploited an insecure direct object reference vulnerability on the company's web server, allowing unauthorized access to names, social security numbers, driver's license numbers, and other personal data.
The company has since closed the security gap and is reviewing affected records to notify impacted individuals and regulators. For retail investors, the immediate financial impact appears contained—management states the incident won't materially affect operations, and the company carries cybersecurity insurance.
However, the breach involved highly sensitive data that could expose the company to regulatory penalties, litigation from affected contractors, and reputational damage in an industry already facing scrutiny. The fact that numerous contractors were affected suggests a potentially significant scope. Investors should watch for: (1) any updates on the number of affected individuals, which will determine notification costs and litigation exposure; (2) regulatory actions from state attorneys general or the FTC; and (3) whether insurance coverage proves adequate for all costs. The next earnings call should address total remediation expenses and any operational disruptions from the enhanced security measures now in place.
Section-by-Section Diff
Event · Item 8.01 — Other Events
RCI subsidiary suffered cybersecurity breach exposing independent contractor personal data including SSNs; incident contained, no material impact expected.
Added in current filing · verify on EDGAR →
RCI Internet Services, Inc., a subsidiary of RCI Hospitality Holdings, Inc., (the “Company”), recently discovered on March 23, 2026 that it sustained a cybersecurity incident starting March 19, 2026.
The company disclosed a cybersecurity incident at its subsidiary that began March 19, 2026 and was discovered four days later. The breach involved an insecure direct object reference vulnerability on the company's web server that allowed unauthorized access to personal information of numerous independent contractors, including names, contact information, dates of birth, social security numbers, and driver's license numbers. The company has remediated the vulnerability by enhancing security measures including multifactor authentication and disabling external access to the affected server.
Added in current filing · verify on EDGAR →
As a result of this incident, the Company believes that certain personal information, including names and contact information, dates of birth, social security numbers, and driver’s license numbers, with respect to numerous independent contractors was accessed without authorization.
Sensitive personal information of numerous independent contractors was compromised, including social security numbers and driver's license numbers. However, the company states that no customer information or financial systems were accessed, and the unauthorized actor has not publicly disseminated the data. The company is reviewing impacted data and will notify affected parties and regulatory entities as required.
Thanks — your feedback helps us improve report quality.
Figures/quotes linked to EDGAR · Narrative written by AI · Jun 3, 2026 · How we verify