RCI HOSPITALITY HOLDINGS, INC.

RCI Internet Services left an insecure direct object reference on its public-facing IIS web server, so the application checked who was logged in but never whether the record requested was actually theirs. Changing a number in the URL was enough to walk out with contractor files on about 40,178 people, Social Security and driver's license numbers included. Its remediation, adding multifactor authentication and cutting external access, names the wall that was never there. Authorization was not breached here; it was never enforced past the login screen.