RCI Internet Services says March data breach affected over 40,000 people

Texas-based technology and IT management services company RCI Internet Services said a data security incident it suffered in March compromised the sensitive personal information of over 40,000 customers.

 

RCI Internet Services, a Houston, Texas-based technology and IT management services provider and subsidiary of RCI Hospitality Holdings, functions as the organisation’s IT arm, supporting its operations and technology infrastructure. RCI Hospitality Holdings operates a portfolio of hospitality and adult entertainment venues across the United States.

 

In a data security incident notice filed with the Office of Maine Attorney General, RCI said that on March 23, it experienced a network disruption resulting from unauthorised access to its internal network.

 

Upon discovering the incident, the company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. It also took steps to secure the affected network and notified relevant law enforcement authorities about the incident.

 

“As a result of the investigation, we determined that certain files were accessed and acquired without authorisation on March 19, 2026,” RCI said.

 

The compromised data included names, social security numbers, driver’s license numbers, and passport numbers. The filing with the Maine state regulator also states that at least 40,178 individuals were impacted by the incident.

 

The company has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered one year of complimentary identity protection and credit monitoring services through IDX to all affected individuals.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on RCI. The company also did not share details on who was behind the attack, how much data was compromised, or whether it had received a ransom demand.