PMA Consultants data breach (2025)

🦞Maine State AGFirst filing

Filed Jan 30, 2025bd_e55973011bb404be

PMA Consultants, a consulting firm based in Ann Arbor, MI, experienced an external system breach (hacking) between May 4–7, 2024. The breach was not discovered until December 23, 2024 — approximately seven months later. A total of 273 individuals were affected nationwide, including 4 Maine residents. Affected individuals were notified in writing on January 29, 2025, and offered 12 months of complimentary credit monitoring and identity protection services through Cyberscout (TransUnion).

Affected (this filing): 4

⛰️New Hampshire State AG

Filed Jan 30, 2025bd_fee1b469d6f3bacd

PMA Consultants, a professional services firm, notified the New Hampshire Attorney General on January 30, 2025, of a ransomware attack discovered on May 7, 2024. The incident affected 4 New Hampshire residents. PMA engaged third-party forensic specialists, reported to federal law enforcement, and sent notices to affected individuals offering credit monitoring. The scope of data exposure was determined through a comprehensive review completed in December 2024.

Affected (this filing): 4

⛰️New Hampshire State AGlinked via multistate filing link · 95%

Filed Mar 17, 2025bd_7d2860b96ee0522a

PMA Consultants, a professional services firm, issued a supplemental notification regarding a ransomware attack discovered on May 7, 2024. The incident resulted in unauthorized access to PII of 6 New Hampshire residents. PMA engaged forensic specialists, reported to federal law enforcement, and offered credit monitoring services.

Affected (this filing): 6

🏎️Indiana State AGlinked via multistate filing link · 95%

Filed Mar 17, 2025bd_93723ad4fd281834

PMA Consultants reported a data breach to the Indiana Attorney General. The breach occurred on 2024-05-04 and was reported on 2025-03-17. 3 Indiana residents were affected. 1,801 individuals affected in total.

Affected (this filing): 1,801

🦀Maryland State AGlinked via multistate filing link · 95%

Filed Mar 17, 2025bd_fd0865727c08d584

PMA Consultants notified the Maryland AG of a ransomware attack discovered on May 7, 2024. The incident affected 5 Maryland residents, exposing names, SSNs, alien registration numbers, passport numbers, driver's license numbers, and health insurance information. PMA engaged forensic specialists, reported to federal law enforcement, and offered 12 months of credit monitoring. The investigation and data review were ongoing at the time of notification.

Affected (this filing): 5

MD AG >90d

PMA Consultants

Litigation Timing

Affected residents by state

Timeline