RCI Hospitality Discloses Data Breach Affecting Independent Contractors
RCI Hospitality Holdings, a major operator of adult nightclubs in the United States, has reported a cybersecurity incident that exposed sensitive personal information. The breach was discovered on March 23 by RCI Internet Services, a subsidiary of the company, due to an insecure direct object reference (IDOR) vulnerability in an IIS web server. This vulnerability allowed unauthorized access to personal data, including names, dates of birth, contact information, Social Security numbers, and driver's license numbers of numerous independent contractors. The company has stated that no customer information or financial systems were accessed, and business operations were not affected. The breach began on March 19, and the company has not identified any public dissemination of the data. 
