ERHC Data Breach Affects Patient Info

Published
September 29, 2025
Updated
September 30, 2025
ERHC Data Breach Affects Patient Info
Emergency Responders Health Center
Types of INFORMATION affected
  • Names
    Names
  • Social security numbers
    Social Security Numbers
  • Dates of birth
    Dates of Birth
  • Addresses
    Addresses
  • Government IDs
    Government IDs
  • Medical Information
    Medical Info
  • Financial Info
    Financial Info

Affected by the

Emergency Responders Health Center

data breach?

Join the Lawsuit

It's free to join. 

Banner advertisement for ExpressVPN to take control of your online security

Claim Depot may receieve a commission from links on this page

Emergency Responders Health Center (ERHC), a specialized medical provider for first responders, experienced a cyberattack. On April 11, 2025, the healthcare organization discovered suspicious activity within its email network. An investigation was launched and it was determined that several email accounts were compromised by an unauthorized actor between Dec. 11, 2024, and April 11, 2025.

This type of data breach often compromises both personally identifiable information (PII) and protected health information (PHI). In addition to names, exposed information may include addresses, dates of birth, Social Security numbers, driver's license copies, health insurance information, medical records and payment information.

Emergency Responders Health Center published a Notice of Data Security Incident on its website on July 23, 2025. The investigation was completed on Sept. 16, 2025 and the medical group began notifying impacted individuals by mail on Sept. 26, 2025.

The total number of affected individuals has not been released but is believed to include both current and former patients. ERHC disclosed the data breach to the Montana Attorney General's office and the Washington Attorney General on Sept. 26, 2025.

Emergency Responders Health Center's response

Upon discovering the breach, ERHC secured the hacked email accounts and engaged a cybersecurity firm to investigate the incident. In addition to required state and federal disclosures, the medical group is offering affected individuals 12 months of free HaystackID credit monitoring and identity restoration services.

If you receive notification from ERHC about this breach, you may want to:

  • Sign up for the free credit monitoring services, offered by the organization.
  • Monitor your credit reports and financial accounts for any unusual activity.
  • Be alert for phishing emails or phone calls that may use your exposed information.
  • Consider placing a fraud alert or credit freeze with major credit bureaus.

Emergency Responders Health Center also set up a dedicated assistance line for individuals with questions at 800-695-7289, Monday through Friday, 8:00 a.m. and 8:00 p.m. Eastern Time.

For more information about the medical provider, visit the Emergency Responders Health Center website.

Protect Your Data

A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.

This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.

Notice Letter

This browser does not support inline PDFs. Please download the PDF to view it: Download PDF

Consumers Notification date
Date of Breach
April 11, 2025
Breach Discovered Date
Total People Affected
Information Types Exposed
  • Name
  • Social Security Number
  • Driver's License or Washington ID Card Number
  • Full Date of Birth
  • Health Insurance Policy or ID Number
  • Medical Information
CTA Image
CTA Image
CTA Image
CTA Image
CTA Image
CTA Image
CTA Image
CTA Image
CTA Image