On June 19, 2025, Risk Management Services LLC (RMS), a Louisiana-based third-party administrator, detected a data breach exposing the personal and protected health information (PHI) of at least 22,300 individuals. An unauthorized actor infiltrated RMS’s internal systems around February 23, 2025, potentially accessing sensitive data, including full names, addresses, dates of birth, Social Security numbers, and medical records tied to workplace injuries. RMS serves as an administrator for insurance entities like LCTA Mutual Holding Co., LCTA Casualty Insurance Co., and LCTA Workers’ Comp, amplifying the breach’s reach. The company initiated containment measures, engaged cybersecurity experts, and notified law enforcement. Affected individuals were informed via mail starting August 29, 2025, with disclosures also submitted to the Maine Attorney General’s office on September 2, 2025. RMS offered free credit monitoring and identity theft protection through Epiq Privacy Solutions to mitigate risks. The breach underscores vulnerabilities in third-party administrative systems handling highly sensitive employee and customer data, raising concerns over long-term identity theft and fraud risks for victims.