• RCI Hospitality disclosed a cybersecurity incident at its RCI Internet Services unit, discovered March 23, 2026, with activity starting March 19, 2026.
• Business operations were not impacted, with no access to customer information or financial systems.
• Investigation concluded April 7, 2026, identifying a potential insecure direct object reference vulnerability on an IIS web server.
• Remediation expanded multifactor authentication, with external access to IIS disabled.
• Company believes unauthorized access involved personal data of numerous independent contractors, with no public dissemination known.

Disclaimer: This news brief was created by Public Technologies (PUBT) using generative artificial intelligence. While PUBT strives to provide accurate and timely information, this AI-generated content is for informational purposes only and should not be interpreted as financial, investment, or legal advice. RCI Hospitality Holdings Inc. published the original content used to generate this news brief via EDGAR, the Electronic Data Gathering, Analysis, and Retrieval system operated by the U.S. Securities and Exchange Commission (Ref. ID: 0001628280-26-024806), on April 13, 2026, and is solely responsible for the information contained therein.