HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryIdentity (basic)MediumContained

IMA Diligence Services

bd_8f50a59fb1559a98 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 16, 2025

Filed

Jun 1, 2026

To disclose

24 weeks

Affected

70,266state residents only

Linked

9 filings

Confidence

63%

Full breach record for IMA Diligence Services →3 incidents on file

IMA Diligence Services, LLC notified South Carolina and other state regulators of a breach involving a decommissioned third-party legacy server. Unauthorized access occurred between Dec 8-16, 2025, exposing names and limited PII. No misuse confirmed. 12 months credit monitoring offered. ~1,464 Rhode Island residents impacted; total count undisclosed.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due24 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 8 days

discovery → filing · 24 weeks / 167 days

Dec 8, 2025

Begins

Dec 16, 2025

Discovered

Jun 1, 2026

Filed

vs. sector median

+4 wks slower

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_16e5e71a5f4991312026-05-29 · +3dVerified
Oregon State AGbd_251ec6b205f440ae2026-05-29 · +3dVerified by operator
New Hampshire State AGbd_3bd537247ac6bc062026-05-29 · +3dVerified
Vermont State AGbd_4c7e828b895829652026-05-29 · +3dVerified

Show 4 more filings ↓up to 3d gap

Indiana State AGbd_5cecf8343e66696f2026-05-29 · +3dVerified
California State AGbd_c997f1d0e86131f52026-05-29 · +3dVerified
Washington State AGbd_ccd420ce52718acd2026-05-29 · +3dVerified by operator
Massachusetts State AGbd_ec7a7a80f0d522ba2026-05-29 · +3dCandidate

Name: IMA
norm: ima
Domain: imanet.org

Name: IMA Diligence Services
norm: ima diligence
Domain: imadiligence.com
Industry: Professional Servicesllm

Discovered: Dec 16, 2025
Breach occurred: Dec 8, 2025 – Dec 16, 2025
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 29, 2026
Affected individuals: 70,266state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Will notify applicable regulatory authorities where necessary

During the incident: Notified law enforcement
Engaged third-party cybersecurity specialists to conduct an investigation
Providing twelve (12) months of complimentary access to credit monitoring and identity restoration services through Cyberscout
Changes made: Reviewing policies, procedures and processes related to the storage and access of personal information to reduce the likelihood of a similar future event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(167 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.