ERMI data breach: employee email accounts open for six months in 2025

What happened at ERMI?

ERMI says it moved to contain the incident and investigated with outside cybersecurity professionals. The window it gives ends on August 14, 2025, about three weeks after it learned of the access on July 25. A review of the data then ran until on or about April 17, 2026.

Date	What the letter and the regulators' records say
About February 15, 2025	Start of the window in which files may have been accessed or removed
On or about July 25, 2025	ERMI learns employee email accounts may have been accessed
About August 14, 2025	End of the window
On or about April 17, 2026	Review finds personal information in the files
May 26, 2026	Report to HHS (74,074); notice recorded by California; logged in Massachusetts (22 residents)

The report to HHS came about 10 months after ERMI learned of the access, and more than 15 months after the window opened.

What information was involved?

Each letter lists the reader's own items; the sample filed with California leaves the list blank. For the 22 Massachusetts residents in ERMI's notice, the state's record marks Social Security numbers, medical records and financial accounts as breached. ERMI says it has no evidence that anyone's information has been used for financial fraud or identity theft.

The letter gives readers ways to guard against medical identity theft: protect documents that contain medical information, check medical records and explanation of benefits statements for errors or services not received, and report anything suspicious to the healthcare provider.

What is ERMI offering?

Item	Detail from the letter
Service	Single-bureau credit monitoring, credit report and credit score, for the period printed on each letter
Provider	Cyberscout, a TransUnion company
Enrollment	Within 90 days of the letter date, with the code printed on the letter
Questions	A toll-free line printed on each letter

The guide to credit monitoring offers sets ERMI's offer beside other letters, and the guide to healthcare provider breach notices compares other providers' letters.

What Texas's attorney general recorded

Texas's attorney general lists a report from ERMI LLC, posted on May 28, 2026, with 9,453 Texans affected, a count of Texas residents only. The record lists names, Social Security numbers, driver's license numbers, financial account or card information, medical information, health insurance information and dates of birth as involved.

What the documents leave open

• How the unauthorized individual got into the email accounts.
• What happened between July 25, 2025 and the end of the window on August 14.

With 74,074 people, ERMI's report is the 60th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.