Roush Fenway Keselowski Racing Data Breach Lawsuit

Roush Fenway Keselowski Racing, LLC (“RFK Racing”), a prominent NASCAR team based in Concord, North Carolina, has disclosed a data breach involving unauthorized access to its computer systems. The incident, discovered in May 2025, exposed sensitive personal information, including names, dates of birth, and Social Security numbers of affected individuals.

Roush Fenway Keselowski Racing’s Data Breach Investigation

On May 14, 2025, RFK Racing detected suspicious activity within its internal systems. In response, the organization immediately launched an investigation with the help of third-party cybersecurity and forensic specialists to determine the cause and scope of the incident. The investigation revealed that certain files were accessed or taken without authorization, prompting a full review to determine which individuals and what information were impacted.

After extensive analysis, RFK Racing confirmed on August 4, 2025, that the potentially compromised data contained limited but sensitive personal information, including names, dates of birth, and Social Security numbers. On September 12, 2025, RFK Racing formally notified approximately twelve (12) New Hampshire residents whose information may have been involved.

The organization has since reported the incident to federal law enforcement and is cooperating with the ongoing investigation. In addition, RFK Racing has implemented enhanced cybersecurity measures, including system hardening, employee awareness training, and additional monitoring tools to prevent future incidents.

As part of its response, RFK Racing is offering 24 months of complimentary credit monitoring and identity protection services through Cyberscout, a TransUnion company. The package includes credit monitoring, identity theft recovery assistance, and detailed guidance on protecting personal data. The organization has also provided affected individuals with information on placing fraud alerts, security freezes, and contacting consumer reporting agencies or law enforcement to report identity theft.

When Did This Breach Occur?

The unauthorized access occurred prior to its discovery on May 14, 2025, and was confirmed through investigation completed by August 4, 2025. Notifications to affected individuals were mailed on September 12, 2025.

What Information Was Breached?

The following categories of personal data may have been compromised in the RFK Racing data breach:

• Name
• Date of birth
• Social Security number

While there is no current evidence that the information has been misused, the exposure of Social Security numbers and birth dates presents a significant risk of identity theft and fraud.

What You Can Do

If you received a notification letter from RFK Racing, you should take immediate steps to protect your identity and credit:

1. Enroll in Free Credit Monitoring – Take advantage of the 24 months of complimentary credit monitoring and identity protection services offered through Cyberscout. These services include identity theft recovery support and proactive credit monitoring.
2. Monitor Financial Accounts – Regularly review your bank statements, credit reports, and other financial documents for suspicious activity.
3. Place Fraud Alerts or Credit Freezes – Contact Equifax, Experian, and TransUnion to place a fraud alert or freeze your credit file, preventing new accounts from being opened in your name.
4. Update Account Passwords – Change passwords for online accounts that may be connected to your personal information and enable multi-factor authentication (MFA) for added protection.
5. Report Identity Theft or Fraud – If you notice unusual activity, contact your financial institution immediately and file a report with the Federal Trade Commission (FTC) or your state Attorney General.

Remaining vigilant and using the free monitoring tools provided by RFK Racing can help you stay protected from potential identity theft.

File a Data Breach Lawsuit Against Roush Fenway Keselowski Racing