RCI Internet Services, Inc.

Filing excerpt“RCI Internet Services, Inc., a subsidiary of RCI Hospitality Holdings, Inc., (the "Company"), recently discovered on March 23, 2026 that it sustained a cybersecurity incident starting March 19, 2026. The incident did not impact the business operations of the Company. As the investigation concluded on April 7, 2026, the Company learned that a potential insecure direct object reference vulnerability was present on its Internet Information Services (“IIS”) web server. To remediate, the Company promptly enhanced its technical security posture, including expanding the use of multifactor authentication and disabling external access to the IIS.”