RCI HOSPITALITY HOLDINGS, INC.

RCI HOSPITALITY HOLDINGS, INC. notified SEC Form 8-K on Apr 13, 2026 of a data breach, which occurred on Mar 23, 2026. Data exposed: Social Security number, Financial / bank account, Health insurance.

Case file (dates, days to notice against the statute, what the letter offers, prior incidents)

Organization: RCI HOSPITALITY HOLDINGS, INC.
Source: SEC Form 8-K · source record
Date reported: Apr 13, 2026
Date(s) of breach: March 23, 2026
Residents affected: Not published by this source
Data exposed: Social Security number Financial / bank account Health insurance
Notice letter: Form 8-K filing
Discovered: Mar 23, 2026, as stated in the letter
"ITEM 8.01 OTHER EVENTS RCI Internet Services, Inc., a subsidiary of RCI Hospitality Holdings, Inc., (the “Company”), recently discovered on March 23, 2026 that it sustained a cybersecurity incident starting March 19, 2026."
Days to notice: 21 days from discovery (Mar 23, 2026) to the Federal (SEC) record (Apr 13, 2026).
Third party: The letter attributes the incident to a vendor or service provider
First seen by BreachTally: 2026-11-12 23:17 UTC
Ticker: RICK

Dates and counts as filed by the organization with the agency. The breach window and the report date often differ by months.

Item 8.01 excerpt

ITEM 8.01 OTHER EVENTS RCI Internet Services, Inc., a subsidiary of RCI Hospitality Holdings, Inc., (the “Company”), recently discovered on March 23, 2026 that it sustained a cybersecurity incident starting March 19, 2026. The incident did not impact the business operations of the Company. Upon detecting the incident, the Company promptly took steps to investigate and respond with the assistance of third-party cybersecurity firms. As the investigation concluded on April 7, 2026, the Company learned that a potential insecure direct object reference vulnerability was present on its internet information services (“IIS”) web server. To remediate, the Company promptly enhanced its technical security posture, including expanding the use of multifactor authentication and disabling external access to the IIS. As a result of this incident, the Company believes that certain personal information, including names and contact information, dates of birth, social security numbers, and driver’s license numbers, with respect to numerous independent contractors was accessed without authorization. To the Company’s knowledge, the unauthorized actor has not publicly disseminated the data. None of our customer information or financial systems were accessed. The Company is continuing to review the impacted data and will provide the required notifications to affected parties and applicable regulatory entities. As of the date of this filing, the Company believes that the incident will not have a material adverse effect on its business operations. The Company continues to investigate the incident and will incur expenses in the fiscal year directly and indirectly related to the event. The Company maintains a comprehensive cybersecurity insurance policy, which covers costs associated with the inci

Data reproduced from a public government filing. Spot an error? Email support@breachtally.com with the record link. Corrections are applied and noted.