IMA Diligence Services Notifies 525K on Legacy Server Breach: Ransomware Claim — What’s Alleged & What To Do

More than 525,000 individuals have been notified that personal information held by IMA Diligence Services was taken from a legacy server. The firm, which conducts financial due diligence, began public notifications in early June 2026 after an incident that had earlier been claimed by the Genesis ransomware group.

The scale of the exposure means that a large number of people now face the possibility that records containing their personal details, along with business and confidential documents, have left the organisation’s control. Notifications of this kind require recipients to assess whether their own information was involved and what practical steps may reduce further risk.

Inside the incident

IMA Diligence Services stated that the data was stolen from a legacy server. The company reported the matter on 27 January 2026 and later notified 525,000 individuals. Public reporting and formal notifications to affected people took place in early June 2026. The incident had previously been claimed by the Genesis ransomware group, though no further attribution details have been released by the organisation.

Information released so far does not include the precise date of the intrusion, the method of access, or confirmation of whether the data was encrypted or otherwise protected on the server. The firm has not disclosed whether any of the material has appeared on public forums beyond the initial claim.

How a breach like this happens

Incidents involving legacy servers often begin with systems that remain connected to networks after they are no longer actively maintained. Attackers can locate such servers through routine scanning and exploit unpatched software or weak access controls that were acceptable when the systems were first deployed.

Once initial access is obtained, data can be copied without immediate detection if monitoring is limited. In many cases the organisation learns of the event only after the material surfaces elsewhere or after internal logs are reviewed following an external notification.

Who is IMA Diligence Services?

IMA Diligence Services operates as a financial due diligence firm. Organisations in this sector routinely collect and store detailed records about individuals and companies during background checks, transaction reviews, and compliance assessments. These records frequently include personal identifiers, employment history, financial references, and internal correspondence.

A breach at such a firm is consequential because the data it holds is gathered specifically to support high-stakes decisions by banks, investors, and regulators. When that information leaves the organisation, it can affect both the individuals named in the files and the clients who relied on the firm’s assessments.

What data was at risk

The notification identifies three broad categories of material: personal information, business documents, and confidential files. The organisation has not published a more granular list of fields or confirmed which specific records were present on the affected server.

Firms of this type commonly retain names, addresses, dates of birth, government identifiers, employment and financial details, as well as internal reports and correspondence. Without an itemised disclosure it remains unconfirmed whether every one of these elements was present in the stolen data.

The real-world impact

Individuals whose records were taken may see their details used for identity-related fraud or targeted scams. Business documents and confidential files could also reveal sensitive commercial relationships or internal processes, creating secondary risks for the clients and counterparties named in those records.

For the organisation, the incident brings regulatory reporting obligations, potential legal claims, and the cost of remediation. The use of a legacy server suggests that older infrastructure may require additional review to limit similar exposures in the future.

What to do if you're exposed

Recipients of the notification should review the letter for any reference to their specific records and consider the following immediate actions:

• Place fraud alerts or credit freezes with major credit bureaus.
• Monitor bank and investment accounts for unauthorised activity.
• Change passwords on any accounts that may reuse credentials mentioned in the records.
• Watch for unsolicited contact that references details only the breached data would contain.

Readers can also run a free exposure scan of their email address to check whether their information has appeared in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.