IMA Financial Group
Disclosed Apr 19, 20233 years ago9,428 affectedConfirmed
The business associate (BA), IMA Financial Group, Inc., reported that it experienced a cyber-attack that affected the protected health information (PHI) of 5,242 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and Social Security numbers, claims and financial information, lab results, medications, and other treatment information. The BA notified covered entities and HHS, and provided substitute notice of the breach. In response to the breach the BA implemented additional administrative and technical safeguards to improve its security posture. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 9,428 (as reported by the organization) |
|---|---|
| Disclosed | Apr 19, 2023 |
| Discovered | Mar 10, 2023 |
| Happened | Oct 18, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Finance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: IMA Financial Groupoag.ca.gov · Official notice | Official notice |
| Oregon DOJ breach notice: IMA Financial Groupjustice.oregon.gov · Official notice | Official notice |
| Vermont Attorney General: 2023-05-10 IMA Financial Group Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2023 data breach report: IMA Financial Groupin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): IMA Financial Group (Business Associate, KS)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Apr 19, 2023 | 450 |
| Vermont AGresidents of VT | May 10, 2023 | |
| HHS archivetotal | May 10, 2023 | 5,242 |
| California AGresidents of CA | Jun 28, 2023 | |
| Oregon DOJresidents of OR | Jun 28, 2023 | 48,358 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), IMA Financial Group, Inc., reported that it experienced a cyber-attack that affected the protected health information (PHI) of 5,242 individuals. The PHI involved included names, addresses, dates of birth, drive · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 9428 · backfill source
- 2026-09-25 · disclosed: 2023-05-10 to 2023-04-19 · backfill source
- 2026-09-25 · disclosed: 2023-06-28 to 2023-05-10 · backfill source
- 2026-09-25 · discovered: empty to 2023-03-10 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.