Patients Drop Data Breach Lawsuit Against Georgia Medical Billing Firm A group of patients has voluntarily dismissed a class-action lawsuit against ERMI, a Georgia-based medical billing company, alleging the firm failed to adequately protect sensitive patient and employee data. The lawsuit, filed earlier this year, claimed that ERMI’s security lapses led to a September data breach exposing personal and health-related information. The case centered on accusations that ERMI did not implement sufficient safeguards to prevent unauthorized access to confidential records. While the dismissal halts legal proceedings, the incident underscores ongoing concerns about healthcare data security and the risks of inadequate cybersecurity measures in medical billing operations. No further details on the breach’s scope or the reason for the lawsuit’s withdrawal have been disclosed. The case highlights the growing scrutiny of third-party vendors handling sensitive health data and the potential legal consequences of security failures.

ERMI LLC Data Breach Exposes Sensitive Health Records in Prolonged Cybersecurity Incident A data breach at ERMI LLC, a medical device company based in Atlanta, Georgia, has exposed sensitive health records and personally identifiable information (PII) of affected individuals. The incident, discovered on July 25, 2025, involved unauthorized access to a limited number of employee email accounts. Investigations revealed that the threat actor may have accessed or exfiltrated files between February 15, 2025, and August 14, 2025. After a detailed review, ERMI confirmed on April 17, 2026, that the compromised data included health records. The company, which specializes in home-based motion restoration programs for patients with severe mobility impairments, has not disclosed the total number of individuals impacted. Shamis & Gentile P.A., a class action law firm, is investigating the breach and potential legal claims for affected individuals. Those who received breach notifications may be eligible for compensation. The incident underscores the risks of prolonged unauthorized access in healthcare-related cybersecurity breaches.