IMA Diligence Services Data Breach

An unauthorized actor accessed the third-party-hosted legacy file server between December 8 and December 16, 2025, and acquired certain files. IMA Diligence detected suspicious activity on December 16, began an investigation with outside cybersecurity specialists, and decommissioned the server, which is no longer in use. It then reviewed the files in detail to identify the affected information and people.

The information varied by person. The New Hampshire notice identifies names, driver's license numbers, Social Security numbers, and financial-account information, while the Texas Attorney General's record also lists addresses, medical information, and health-insurance information. It does not indicate that every information type applied to every person.

The company assessed the security of its systems, investigated the scope with outside specialists, notified federal law enforcement, and began implementing additional safeguards and employee training. It sent written notices to affected people and offered 12 months of complimentary credit monitoring and identity-restoration services. At the time of the notice, it was not aware of any misuse of the information.

Notice recipients should check their letters for the monitoring-service enrollment deadline and review credit reports, financial accounts, health-insurance explanations, and unexpected medical-service records. People whose Social Security or driver's license numbers were involved may consider a fraud alert or credit freeze based on their circumstances and should independently verify unexpected messages requesting identity information.