Roush Fenway Keselowski Racing Settles Data Breach Class Action in North Carolina On May 4, 2026, Roush Fenway Keselowski Racing LLC, a prominent NASCAR team, sought final approval from a North Carolina federal court for a settlement in a data breach class action lawsuit. The agreement aims to provide affected individuals with protections against fraud and identity theft following the incident. The case centers on a data breach that exposed sensitive information, prompting legal action from impacted parties. While specific details of the breach including the timeline, scope, and exact nature of the compromised data remain undisclosed, the settlement signals a resolution to the dispute. The outcome of this case could set a precedent for how sports organizations and other high-profile entities handle data security incidents and subsequent legal claims. The court’s final approval will determine the settlement’s implementation and the extent of protections offered to class members.

An Illinois man has filed a lawsuit against RFK Racing, a prominent NASCAR team, following a data breach that exposed the personal information of up to 100 individuals. The breach, occurring earlier this year, allegedly resulted from the company’s failure to implement adequate cybersecurity measures to safeguard sensitive data. While the exact type of compromised information (e.g., financial records, Social Security numbers, or contact details) was not specified in the article, the legal action suggests the exposure could lead to identity theft, fraud, or reputational harm for affected individuals. The lawsuit underscores concerns over RFK Racing’s negligence in data protection, though the scale of the breach appears limited compared to larger corporate incidents. No evidence suggests ransomware, systemic operational disruption, or broader economic consequences, but the incident highlights vulnerabilities in the organization’s cybersecurity posture.

On May 14, 2025, RFK Racing detected suspicious activity on its network, later confirming a cybersecurity breach where a cybercriminal accessed files containing personally identifiable information (PII). The investigation, concluded on August 4, 2025, revealed that the breach exposed sensitive data of 13,362 individuals, including names, contact details, dates of birth, and Social Security numbers. The company notified affected individuals via written letters on September 12, 2025, and disclosed the incident to the Attorney General offices of Maine, Massachusetts, Vermont, and New Hampshire. As a remedial measure, RFK Racing offered 24 months of free TransUnion Cyberscout credit monitoring to victims. The breach posed risks of identity theft, financial fraud, and phishing attacks targeting the exposed individuals. The incident underscored vulnerabilities in RFK Racing’s data security, leading to potential long-term reputational and financial repercussions for both the company and the affected parties.