Company Facts

Receivables Performance Management, LLC, commonly abbreviated RPM, was founded in 2002 by Howard L. George and operates from 20818 44th Avenue West, Suite 140, in Lynnwood, Washington 98036, north of Seattle.

Consumer facing numbers reported on account correspondence include (866) 367-1878 and (877) 297-3158, with a corporate line at (425) 412-2600. The website is receivablesperformance.com.

RPM is a third party collection agency working consumer accounts placed by creditors across several verticals, including telecommunications, utilities, financial services, and healthcare. It is not primarily a debt buyer.

Washington licenses collection agencies through its Department of Licensing under the state's Collection Agency Act, which gives Washington consumers a state level verification and complaint channel alongside the federal one.

The 2021 Data Breach

This is the most significant public fact about the company and it is worth stating precisely.

RPM's systems were first breached on April 8, 2021. The intrusion was detected on May 12, 2021, and unauthorized access continued through approximately May 21. The exposure affected 3,766,573 individuals, and the compromised data included names and Social Security numbers along with other personally identifying information.

Litigation followed, and the matter resolved through a class action settlement reported at $5.6 million.

A settlement is a negotiated resolution rather than a finding on every allegation. What the incident illustrates, and the reason it belongs in a profile rather than a footnote, is structural.

The Problem Nobody Consents To

Consider how your information reaches a collection agency in the first place.

You opened an account with a hospital, a wireless carrier, or a lender. That company collected your name, address, date of birth, and Social Security number. When the account went delinquent, it transferred that data to a collection agency you had never heard of, under a contract you never saw, and you were not asked.

The agency now holds a complete identity theft package on you. You did not choose it, cannot vet its security practices, and generally cannot demand that it delete your data while the account is open.

That is the arrangement across the entire industry, and it is why data security at collection agencies is a consumer issue rather than a vendor procurement detail. Millions of people affected by any collection agency breach had no relationship with the breached company.

What to Do If Your Data Was Exposed

If you receive a breach notice from a collection agency, or discover you were affected, the response is the same as for any Social Security number exposure and the urgency is higher than for a breach involving only email addresses.

Place a fraud alert with one of the three credit bureaus, which requires that bureau to notify the other two, and consider a credit freeze, which is free and blocks new accounts from being opened in your name. A freeze is the stronger measure and can be lifted temporarily when you need credit.

Take the credit monitoring if it is offered in the notice or the settlement, and actually read the reports rather than assuming enrollment is protection.

Pull your credit reports and check for accounts you did not open.

Watch for tax related fraud, since Social Security numbers are used to file fraudulent returns, and consider requesting an IRS identity protection PIN.

And be alert to follow on scams. Breach victim lists circulate, and people who received a breach notice get contacted by callers claiming to help, sometimes claiming to be from the breached company. Verify independently before giving anyone information.

Any of this is separate from whether you owe the underlying debt.

The Ordinary Verification Sequence Still Applies

If RPM is contacting you about a balance, the breach does not change your rights on the account itself.

The first written communication must include validation information covering the amount claimed, the creditor the debt is owed to, an itemization of the balance, and notice of the right to dispute. Disputing in writing within 30 days suspends collection until verification is mailed. Our explainer on what a validation notice must contain covers the baseline.

Make the dispute specific. Ask for the original creditor's name, the original account number, the date of default or last payment, the balance at charge off, and an accounting of anything added since. Telecom and utility accounts in particular are frequently placed with thin documentation, and specificity surfaces that quickly. Our guide to disputing a debt collection claim covers how to make it count.

Keep phone contact short and move the substance to writing, an approach laid out in what to say to debt collectors. Given the breach history, be particularly careful about providing additional personal information over the phone to anyone claiming to be from a collection agency, and call back on a number you verified independently.

Check your state's statute of limitations before paying anything on an older account, since a payment or written acknowledgment restarts the clock in many states. And remember that a collection tradeline stays on a credit report for seven years from the original delinquency on the underlying account.

Complaints go to the CFPB's debt collection resource center, which publishes a searchable complaint database, and for Washington operations to the state's licensing authority and attorney general.

What Creditors Should Take From This

If you place accounts with an agency, your customers' data goes with them, and a breach at the agency becomes your problem too. Patients, tenants, and customers do not distinguish between the provider and the vendor.

Data security diligence belongs in agency selection alongside licensing and fee structure. Ask for SOC 2 reporting, PCI compliance for payment handling, encryption in transit and at rest, and a breach notification obligation with a defined timeframe written into the contract. Ask what happens to your data when the relationship ends, and require return or certified destruction.

Limit what you send. An agency needs identity and contact information, the amount, the dates, and the account history. It generally does not need every field in your system, and transmitting more than necessary increases exposure without improving recovery. Where healthcare data is involved, a business associate agreement is required before anything moves.

Our full diligence checklist, written for healthcare but applicable broadly, is in the medical collection agency vetting checklist.

How It Compares

RPM is a mid sized generalist working consumer accounts across several verticals, which is the most common shape in this industry.

Rental and property management collections require a different specialization. A move out balance turns on a lease, an itemized ledger, a security deposit disposition, and dated inspection photographs, and resolving a dispute means someone pulling the file to answer a question about one line item. Advanced Collection Bureau works residential, apartment, student housing, and medical placements on contingency out of Rockledge, Florida, and can be reached at 321-633-4999 or through its residential services page.