IMA Diligence Services (A Division of IMA Financial Group) Listed by genesis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
IMA Diligence Services, a division of IMA Financial Group, was listed by the genesis ransomware group on January 27, 2026, after internal files were exfiltrated in a ransomware attack. Individuals who may have had dealings with the firm should review any notifications and consider protective steps such as monitoring accounts and changing passwords.
What happened
The available information is limited to the genesis listing itself. It claims that files were removed from systems belonging to IMA Diligence Services. No date of the intrusion, volume of data, or method of access has been disclosed publicly. The organization has not issued a statement confirming or denying the incident, and the number of people whose information may be involved remains unknown.
Who is genesis?
Genesis is a ransomware group that maintains a public leak site where it lists organizations it claims to have compromised. The group typically posts samples of data and sets deadlines for payment before releasing additional material. Such listings represent the group’s assertions rather than independently verified events. Genesis has appeared in connection with incidents across multiple industries in recent years, following the common ransomware pattern of encrypting systems and threatening to publish stolen files.
About IMA Financial Group
IMA Financial Group provides financial services, including through its IMA Diligence Services division. Organizations in this sector routinely process client financial records, insurance documentation, and related administrative data. A breach at such a firm can affect both corporate operations and the personal or business information entrusted to it by clients.
The information in question
The genesis listing refers only to “internal files” without further description. The precise categories of data involved have not been confirmed by IMA Financial Group or by any official notification. Financial-services firms commonly hold records such as account details, identification documents, and transaction histories, but it is not known whether any of these were among the files referenced in the listing.
What's at stake
Exfiltrated internal files can contain information that enables targeted fraud, account takeover attempts, or further social-engineering attacks against clients and employees. For the organization, the incident may lead to regulatory scrutiny, operational disruption, and costs associated with investigation and remediation. Because the scale and contents remain undisclosed, the full extent of potential harm cannot yet be assessed.
Were you affected?
Individuals who are clients or former clients of IMA Financial Group or its divisions should monitor their financial accounts and correspondence for unusual activity. Organizations that hold personal data are often required to notify affected parties once an incident is confirmed; until then, direct inquiries to the company remain the primary channel for information. Running a free exposure scan of one’s email address against known breach repositories can indicate whether the address has appeared in previously published data sets, though it will not confirm involvement in this specific incident.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Cedar Street Capital (A part of a Cynvestors Limited Partnership) Listed by genesis Ransomware GroupUnited Personnel (a division of Masis Staffing Solutions) Listed by genesis Ransomware GroupThe Associated Builders and Contractors of Indiana/Kentucky Listed by genesis Ransomware GroupIntegrated Process Engineers & Constructors. Listed by genesis Ransomware GroupLatest breaches
Publicly posted by genesis — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.