Risk Program Administrators LLC Reports Data Breach Affecting 8,309 Individuals Risk Program Administrators LLC, a U.S.-based insurance program administration firm serving public entities, private organizations, faith-based groups, and nonprofits, disclosed a data breach impacting 8,309 individuals. The incident, classified as a "data privacy event," exposed both personally identifiable information (PII) and protected health information (PHI). Unauthorized activity was detected within the company’s systems between May 27 and June 16, 2025, though the breach was only reported to the U.S. Department of Health and Human Services (HHS) on July 23, 2026 over three years later. A public notice was posted on the company’s website on July 22, 2026. Compromised Data: - PII: Full names, Social Security numbers, home addresses, dates of birth, driver’s license numbers, financial account details, and payment information. - PHI: Admission dates, health insurance data, medical conditions, physician details, treatment records, subscriber/member numbers, treatment costs, and locations. Risk Program Administrators has begun notifying affected individuals and directing them to the company’s notice page for updates on protective measures. The delayed reporting raises concerns about compliance and response timelines in data security incidents.