RCI Hospitality Notifies 40K on Data Breach

RCI Hospitality Holdings, the operator of numerous adult nightclubs across the United States, has notified approximately 40,000 individuals that their personal data was exposed in a network intrusion that occurred in March 2026.

According to the company's regulatory filings, the breach stemmed from an Insecure Direct Object Reference (IDOR) vulnerability that allowed unauthorized access to sensitive records. The compromised information includes full names, Social Security numbers, driver's license details, contact information, and dates of birth. Public reporting indicates the majority of those affected were independent contractors who worked with the company's venues. RCI completed its breach notifications to impacted individuals and state authorities in the first week of June 2026.

This incident matters because the combination of Social Security numbers, driver's licenses, and dates of birth gives criminals the core building blocks needed to open fraudulent accounts, file fake tax returns, or impersonate you with government agencies. For you and your family, that exposure can translate into years of paperwork, credit damage, and constant vigilance. Even if you only worked a handful of shifts at one of the clubs, your full identity profile may now be circulating among threat actors who buy and sell such records on underground forums.

The doxxing and identity-chain implications make the situation more serious. Once criminals possess your name, SSN, and date of birth, they can cross-reference that data with usernames, email addresses, or phone numbers you have used elsewhere. This process often reveals linked social media accounts, gaming profiles, and family member connections. Credential leaks of this nature frequently cascade into account takeovers, especially on gaming platforms where children use household email addresses or shared phone numbers. What begins as a contractor record can quickly grow into a complete digital map of your household.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate the password you used anywhere it overlaps with RCI systems or any contractor portal, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure is flagged within hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children's gaming accounts, which often chain back to the same addresses and contact details now exposed.
• Let the remediation specialists handle takedown requests across data brokers and risky sites on your behalf while you focus on securing your own accounts.

The reality is that one breach rarely stays isolated. Criminals treat these datasets as starter material for larger campaigns that can stretch across years. Starting with a DoxxScan gives you both immediate visibility into your current exposure and ongoing protection through its continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and family coverage that includes children's gaming accounts. Taking measured steps now limits how far attackers can travel with the information reportedly taken from RCI.