In 2025, a Maryland-based firm providing AI-powered services (identity or background verification) was hacked, with the breach disclosed in early 2026 affecting approximately 3.1 million individuals. The firm disclosed the breach to HHS OCR and state attorneys general. Exposed data included personally identifiable information processed through AI workflows. The incident highlights emerging risks at AI-powered data processing intermediaries holding large volumes of sensitive personal data.