On May 14, 2025, RFK Racing detected suspicious activity on its network, later confirming a cybersecurity breach where a cybercriminal accessed files containing personally identifiable information (PII). The investigation, concluded on August 4, 2025, revealed that the breach exposed sensitive data of 13,362 individuals, including names, contact details, dates of birth, and Social Security numbers. The company notified affected individuals via written letters on September 12, 2025, and disclosed the incident to the Attorney General offices of Maine, Massachusetts, Vermont, and New Hampshire. As a remedial measure, RFK Racing offered 24 months of free TransUnion Cyberscout credit monitoring to victims. The breach posed risks of identity theft, financial fraud, and phishing attacks targeting the exposed individuals. The incident underscored vulnerabilities in RFK Racing’s data security, leading to potential long-term reputational and financial repercussions for both the company and the affected parties.
Source: https://www.claimdepot.com/data-breach/rfk-racing-2025
TPRM report: https://www.rankiteo.com/company/rfkracing
"id": "rfk1502415091625",
"linkid": "rfkracing",
"type": "Breach",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 13362,
'industry': 'Motorsports (NASCAR Team)',
'location': 'United States',
'name': 'Roush Fenway Keselowski Racing, LLC (RFK '
'Racing)',
'type': 'Private Company'}],
'customer_advisories': 'Written letters sent to affected individuals on '
'September 12, 2025, with guidance on credit '
'monitoring and fraud prevention.',
'data_breach': {'data_exfiltration': True,
'number_of_records_exposed': 13362,
'personally_identifiable_information': ['Names',
'Contact Information',
'Dates of Birth',
'Social Security '
'Numbers'],
'sensitivity_of_data': 'High (includes SSNs)',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)']},
'date_detected': '2025-05-14',
'date_publicly_disclosed': '2025-09-12',
'description': 'On May 14, 2025, Roush Fenway Keselowski Racing (RFK Racing) '
'detected suspicious activity on its network. An investigation '
'revealed unauthorized access or acquisition of files '
'containing sensitive personally identifiable information '
'(PII) of approximately 13,362 individuals. The compromised '
'data included names, contact information, dates of birth, and '
'Social Security numbers. RFK Racing notified affected '
'individuals and regulatory authorities in September 2025 and '
'offered 24 months of free credit monitoring services via '
'TransUnion Cyberscout.',
'impact': {'brand_reputation_impact': 'Potential reputational harm due to '
'exposure of PII',
'data_compromised': ['Names',
'Contact Information',
'Dates of Birth',
'Social Security Numbers (SSNs)'],
'identity_theft_risk': 'High (due to exposure of SSNs and PII)'},
'investigation_status': 'Completed (as of August 4, 2025)',
'recommendations': ['Sign up for the free 24-month credit monitoring service '
'provided by RFK Racing.',
'Monitor credit reports and financial accounts for '
'unusual activity.',
'Be vigilant against phishing attempts leveraging exposed '
'PII.',
'Consider placing a fraud alert or credit freeze with '
'major credit bureaus.'],
'references': [{'source': 'RFK Racing Breach Notification (Public Advisory)'},
{'source': 'RFK Racing Official Website',
'url': 'https://www.rfkracing.com'}],
'regulatory_compliance': {'regulatory_notifications': ['Maine Attorney '
'General’s Office',
'Massachusetts '
'Attorney General’s '
'Office',
'Vermont Attorney '
'General’s Office',
'New Hampshire '
'Attorney General’s '
'Office']},
'response': {'communication_strategy': {'affected_individuals_notified_via': 'Written '
'letter',
'public_advisory': 'Recommendations '
'provided to '
'affected '
'individuals '
'(e.g., credit '
'monitoring '
'signup, fraud '
'alerts, phishing '
'awareness)',
'regulatory_disclosures': ['Maine '
'Attorney '
'General’s '
'Office',
'Massachusetts '
'Attorney '
'General’s '
'Office',
'Vermont '
'Attorney '
'General’s '
'Office',
'New '
'Hampshire '
'Attorney '
'General’s '
'Office']},
'incident_response_plan_activated': True,
'recovery_measures': {'credit_monitoring_offered': '24 months of '
'single-bureau '
'credit '
'monitoring '
'(TransUnion)'},
'third_party_assistance': {'credit_monitoring_provider': 'TransUnion '
'Cyberscout'}},
'title': 'RFK Racing Cybersecurity Incident (2025)',
'type': 'Data Breach'}