Emergency Responders Health Center (ERHC), a specialized medical provider for first responders, experienced a cyberattack. On April 11, 2025, the healthcare organization discovered suspicious activity within its email network. An investigation was launched and it was determined that several email accounts were compromised by an unauthorized actor between Dec. 11, 2024, and April 11, 2025.
This type of data breach often compromises both personally identifiable information (PII) and protected health information (PHI). In addition to names, exposed information may include addresses, dates of birth, Social Security numbers, driver's license copies, health insurance information, medical records and payment information.
Emergency Responders Health Center published a Notice of Data Security Incident on its website on July 23, 2025. The investigation was completed on Sept. 16, 2025 and the medical group began notifying impacted individuals by mail on Sept. 26, 2025.
The total number of affected individuals has not been released but is believed to include both current and former patients. ERHC disclosed the data breach to the Montana Attorney General's office and the Washington Attorney General on Sept. 26, 2025.
Upon discovering the breach, ERHC secured the hacked email accounts and engaged a cybersecurity firm to investigate the incident. In addition to required state and federal disclosures, the medical group is offering affected individuals 12 months of free HaystackID credit monitoring and identity restoration services.
If you receive notification from ERHC about this breach, you may want to:
Emergency Responders Health Center also set up a dedicated assistance line for individuals with questions at 800-695-7289, Monday through Friday, 8:00 a.m. and 8:00 p.m. Eastern Time.
For more information about the medical provider, visit the Emergency Responders Health Center website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.