Receivables Performance Management

Receivables Performance Management, also known as RPM, functions as an accounts receivable firm that provides debt collection services. The company works with clients in various industries to recover outstanding invoices and manage delinquent accounts. As part of its service offering, RPM handles consumer information that includes personal identifiers such as names and Social Security numbers. Its headquarters is situated in the United States, with public references identifying the firm as being based in Washington state. The core activity of RPM revolves around receivables performance management, aiming to improve cash flow for its creditor clients.

On May 12, 2021, RPM disclosed that it had suffered a ransomware attack that compromised its internal systems. The intrusion allowed unauthorized actors to access and exfiltrate sensitive consumer data, including names and Social Security numbers. According to the breach notification, the personal information of over 3.7 million individuals was exposed in the incident. Investigators determined that the attackers remained undetected within the network for more than a month before the breach was discovered. Following detection, RPM took immediate containment steps by disconnecting the affected systems and subsequently rebuilding its servers.

To investigate the attack, the company engaged third‑party cybersecurity experts who conducted a forensic analysis of the compromised environment. The firm’s handling of large volumes of personally identifiable information places it under regulatory obligations related to data protection and privacy statutes. In the aftermath of the breach, RPM distributed notification letters to the affected individuals approximately eighteen months after the initial discovery of the intrusion. This delayed notification timeline was noted in public reports concerning the incident. RPM’s specialization in debt collection across multiple sectors distinguishes it within the broader financial services industry. No explicit information about the company’s ownership structure or parent‑subsidiary relationships is provided in the available sources.