IMA Diligence Services data breach: why a due-diligence firm had your files, and what was taken

Why did I get a letter from IMA Diligence?

The letter says the firm holds people's data because it provides professional services that involve analysing data shared with it. It does not name the clients whose data it held. The guide to letters from companies you never dealt with explains how vendors end up holding people's records.

What happened at IMA Diligence?

On or about December 16, 2025, IMA Diligence learned that files on the third-party-managed legacy server were inaccessible. It brought in outside cybersecurity specialists, notified law enforcement and then reviewed the files to find whose information they held.

Date	What the letter and the regulators' records say
December 8, 2025	Unauthorized access to the file server begins
December 16, 2025	IMA Diligence finds the files inaccessible; access ends
May 29, 2026	Letter date; recorded by Indiana, Washington and Massachusetts
June 1, 2026	Recorded by California; posted on the Texas attorney general's list

The letters went out 164 days after the discovery. The guide to notice delays compares that with the rest of the log.

What information was involved?

The filed letter leaves the list of data blank, to be filled in for each reader. The state records list the categories:

Regulator	Information it records
Washington attorney general	Name; Social Security number; driver's license or Washington ID card number; financial and banking information; full date of birth; health insurance policy or ID number; medical information
Texas attorney general	Name; address; Social Security number; driver's license number; financial information; medical information; health insurance information
Massachusetts consumer affairs office	Social Security numbers, financial accounts and driver's licenses marked as breached; medical records and payment cards not

The firm says it is not aware of any misuse of the information.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected	525,306
Texas attorney general	Texans	70,928
Indiana attorney general	Indiana residents	3,392
Washington attorney general	Washingtonians	1,977
Massachusetts consumer affairs office	Massachusetts residents	934

It is the 20th largest notice in Indiana's 2026 report.

What is IMA Diligence offering?

Twelve months of credit monitoring and identity restoration from Cyberscout, a TransUnion company, at no cost. People must enroll themselves.

Item	Detail from the letter
Provider	Cyberscout (TransUnion)
Length	12 months
Phone	1-844-593-7939, 8:00 a.m. to 8:00 p.m. Eastern Time, Monday to Friday, excluding holidays
Postal address	430 East Douglas Avenue, Suite 400, Wichita, KS 67202

What the documents leave open

• Which clients' data was on the server, and why it held health insurance and medical information.
• Who managed the legacy server, and how the actor got in.
• Why the files became inaccessible.