ERMI LLC Data Breach Exposes Sensitive Health Records in Prolonged Cybersecurity Incident A data breach at ERMI LLC, a medical device company based in Atlanta, Georgia, has exposed sensitive health records and personally identifiable information (PII) of affected individuals. The incident, discovered on July 25, 2025, involved unauthorized access to a limited number of employee email accounts. Investigations revealed that the threat actor may have accessed or exfiltrated files between February 15, 2025, and August 14, 2025. After a detailed review, ERMI confirmed on April 17, 2026, that the compromised data included health records. The company, which specializes in home-based motion restoration programs for patients with severe mobility impairments, has not disclosed the total number of individuals impacted. Shamis & Gentile P.A., a class action law firm, is investigating the breach and potential legal claims for affected individuals. Those who received breach notifications may be eligible for compensation. The incident underscores the risks of prolonged unauthorized access in healthcare-related cybersecurity breaches.