RCI, LLC

On March 1, 2024, the Vermont Office of the Attorney General disclosed a data breach affecting RCI, LLC, linked to a vulnerability in the MOVEit Transfer software. The incident occurred between May 31, 2023, and June 1, 2023, enabling unauthorized access to sensitive personal data. Compromised information included names, addresses, government-issued identification numbers, and Social Security numbers (SSNs) of affected individuals. While the total number of victims remains unspecified, the breach directly impacted at least 12 individuals from Rhode Island. The exploitation of the MOVEit vulnerability allowed threat actors to exfiltrate personally identifiable information (PII), posing risks of identity theft, financial fraud, and long-term reputational harm to the company. The breach underscores the critical need for robust patch management and third-party software security oversight to prevent exploitation of known vulnerabilities in widely used enterprise tools.

Source: https://ago.vermont.gov/document/2024-03-01-rci-data-breach-notice-consumers

TPRM report: https://www.rankiteo.com/company/root-cause-insights

"id": "roo353090725",
"linkid": "root-cause-insights",
"type": "Breach",
"date": "5/2023",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'At least 12 (from Rhode Island)',
                        'name': 'RCI, LLC',
                        'type': 'Company'}],
 'attack_vector': 'Exploitation of Software Vulnerability',
 'data_breach': {'data_exfiltration': 'Yes',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)',
                                              'Government Identification '
                                              'Numbers',
                                              'Social Security Numbers '
                                              '(SSNs)']},
 'date_publicly_disclosed': '2024-03-01',
 'description': 'On March 1, 2024, the Vermont Office of the Attorney General '
                'reported a data breach involving RCI, LLC, which occurred '
                'between May 31, 2023, and June 1, 2023. The breach was due to '
                'a vulnerability in the MOVEit Transfer software, resulting in '
                'unauthorized access to names, addresses, and government '
                'identification numbers of affected individuals, including '
                'Social Security numbers. At least 12 individuals from Rhode '
                'Island were directly affected.',
 'impact': {'data_compromised': ['Names',
                                 'Addresses',
                                 'Government Identification Numbers',
                                 'Social Security Numbers'],
            'identity_theft_risk': 'High (PII and SSNs exposed)',
            'systems_affected': ['MOVEit Transfer software']},
 'post_incident_analysis': {'root_causes': 'Exploitation of unpatched '
                                           'vulnerability in MOVEit Transfer '
                                           'software'},
 'references': [{'source': 'Vermont Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': 'Vermont Office of the '
                                                       'Attorney General'},
 'title': 'RCI, LLC Data Breach via MOVEit Transfer Vulnerability',
 'type': 'Data Breach',
 'vulnerability_exploited': 'MOVEit Transfer vulnerability'}