IMA Diligence Services imafinancialgroup.com IMA Diligence Services data breach: what happened and what to do
An unauthorized actor copied files from a legacy server used by IMA Diligence Services between December 8 and 16, 2025. Notice letters went out on May 29, 2026. Reports citing the Indiana Attorney General put the total at 525,306 people.
View all 13,115 breaches- Breach date
- 8 Dec 2025
- Affected
- 525,306
- Data exposed
- Names
- Last updated
What happened
IMA Diligence Services is a firm that analyzes data shared by its clients as part of professional services. You may never have heard of it, and that's the catch: it holds information about people who aren't its customers.
On or about December 16, 2025, the company learned that files on a legacy server, run by a third party and since decommissioned, had become inaccessible. Investigators found that an unauthorized actor had been on that server between December 8 and December 16, 2025 and took certain files. The company then reviewed the files to work out whose information they held. Notice letters are dated May 29, 2026, about five months after the intrusion.
What was exposed
The letter says the files held your name plus other details that differ from person to person. Security news outlets covering the filings report addresses, Social Security numbers, driver's license numbers, financial account details, medical and health insurance information and, for some people, passport and tax ID numbers. They cite a count of 525,306 people reported to the Indiana Attorney General.
That mix is the kind identity thieves like: enough to open credit, file a false tax return or build a believable phishing message. IMA Diligence says it isn't aware of any misuse.
What the company did
It notified law enforcement, hired cybersecurity specialists and is reviewing how it stores and controls access to personal data. It offers 12 months of free credit monitoring and identity restoration through Cyberscout, a TransUnion company. Enrollment is your job, because the company can't sign you up. The letter lists a call center at 1-844-593-7939.
What to do if you were in it
- 1
Enroll in the free monitoring
Use the code in your letter before the deadline. It runs for 12 months.
- 2
Freeze your credit
Freeze your credit at Equifax, Experian and TransUnion. It's free, takes a few minutes online per bureau, and stops anyone opening new credit in your name. You can lift it when you need to apply for something.
- 3
Watch for tax and account fraud
If your letter mentions a Social Security or tax ID number, file your tax return early and consider an IRS Identity Protection PIN. Check bank and card statements for charges you don't recognize.
- 4
Expect phishing that mentions the breach
Messages that quote your address or your bank may be real-looking scams. Don't click links in them. Go to the company's site yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures early. It can't remove data from a breach, so the steps above still matter.
Frequently asked
Was I affected by the IMA Diligence Services breach?
The company is mailing letters to people whose information was in the files. If you got one, you were included. Call 1-844-593-7939 if you have questions about yours.
What was exposed?
Your name plus other details that vary by person. Reports describe Social Security numbers, driver's license numbers, financial and medical information in some cases.
How many people were affected?
Reports citing the Indiana Attorney General say 525,306 people.
Why did I get a letter from a company I don't know?
IMA Diligence analyzes data that other organizations share with it, so it can hold your details without you ever dealing with it directly.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
