







On May 14, 2025, Roush Fenway Keselowski Racing, LLC (RFK Racing) discovered suspicious activity on certain systems within its network. An investigation took place and revealed that a cybercriminal accessed or acquired files containing sensitive information.
A review took place and it was determined on Aug. 4, 2025 that the cybersecurity incident compromised personally identifiable information (PII) of an estimated 13,362 individuals. Information exposed included names, addresses, Social Security numbers, dates of birth, driver's license or state ID numbers, health insurance subscriber number, passport number, financial account information, health insurance information, health insurance claim information and medical information.
The company notified affected individuals by written letter on Sept. 12, 2025 and published a security notice on its website.
The breach was also disclosed to the Maine Attorney General’s office, the Massachusetts Attorney General’s office and the Vermont Attorney General’s office, the Montana Attorney General and the New Hampshire Attorney General beginning on Sept. 12, 2025.
The data breach was also disclosed to the U.S. Department of Health and Human Services on Sept. 12, 2025. In addition to PII, the breach compromised the protected health information of at least 2,160 individuals.
In addition to required state and federal disclosures, RFK Racing is offering affected individuals 24 free months of TransUnion Cyberscout single-bureau credit monitoring services.
If you receive notice from Roush Fenway Keselowski Racing  about this breach, you may want to:
More information about the team can be found on the RFK Racing website.

.webp)
.webp)
.webp)

.webp)
.webp)
.webp)
.webp)