ERMI, LLC discovered that an unauthorized individual may have gained access to a limited number of employee email accounts. After containing the incident and bringing in outside cybersecurity professionals, the company determined that some files may have been accessed or removed between approximately February 15, 2025 and August 14, 2025. It took ERMI until around April 17, 2026 to complete its review of those files and confirm that they may have contained personal information belonging to the people it is now notifying. This kind of incident — where an outsider gets into a company’s email system and lingers in files for months before being detected — falls into the broader category of hacking or system intrusion, and it’s a reminder that breaches are often discovered and investigated long after the actual intrusion took place.
