2026 Ermi — employee email compromise (Feb–Aug 2025; health records)
Data compromised
Personal information and health records per notification summaries
Technical writeup
Ermi LLC, an Atlanta orthopedic medical device and motion-therapy company, disclosed unauthorized access to employee email accounts between approximately February 15 and August 14, 2025, reported to California and Vermont regulators with consumer notices published in May 2026. On April 17, 2026 Ermi determined compromised files may have contained personal information including health records. A nationwide victim count was not disclosed in initial AG filings summarized by Claim Depot. Ermi offered Cyberscout/TransUnion credit monitoring via notification letters.
Root cause
Unauthorized access to employee email accounts