McElroy & Associates Suffers Data Breach Exposing PII and PHI of 6,633 Individuals McElroy & Associates, Inc. disclosed a data breach affecting 6,633 individuals in the U.S., exposing personally identifiable information (PII) and protected health information (PHI). The breach was reported to the U.S. Department of Health and Human Services on October 17, 2025, after suspicious activity was detected in an employee’s email account on May 30, 2025. An investigation revealed that an unauthorized actor accessed emails between May 28 and May 30, 2025, compromising sensitive data, including names, Social Security numbers, dates of birth, driver’s license numbers, financial account details, medical records, health insurance information, and login credentials. By September 3, 2025, the company completed its assessment and began mailing notifications to affected individuals, while also publishing a Notice of Data Security Event on its website. In response, McElroy & Associates secured its email systems, conducted a full review of impacted data, and established a dedicated helpline (833-866-9545) for affected individuals. The breach underscores the ongoing risks to sensitive healthcare and financial data in cyber incidents.