Electric Research and Manufacturing Cooperative, Inc., known as ERMCO, a major manufacturer of distribution transformers, has reported a data security incident to the Massachusetts Attorney General. The filing says Social Security numbers, medical records and driver’s license information may have been involved.
ERMCO’s Data Breach Investigation
Electric Research and Manufacturing Cooperative, Inc., commonly called ERMCO, is one of the largest manufacturers of liquid-filled and oil-filled distribution transformers and power solutions in the United States. A company of that size holds personal records on employees, former employees, job applicants and their dependents, including payroll, benefits and health-related paperwork.
The incident came to public attention in early October 2026, when a notification from ERMCO appeared in the Massachusetts Attorney General’s data breach listings. According to the filing, the incident affected 3 Massachusetts residents, and additional people elsewhere in the country may also have been affected.
The information that may have been involved includes Social Security numbers, medical records and driver’s license information, along with names. Descriptions of the filing also refer to other sensitive information that may have been exposed. ERMCO has not, based on the materials available, published a public explanation of what happened.
The details that remain unknown are significant. The sources reviewed for this page do not state when the incident occurred or was discovered, how an unauthorized party may have gained access, whether the event involved ransomware or another kind of attack, or how many people in total received notices. The count of 3 applies only to Massachusetts residents and should not be read as the total number of people affected nationwide. No nationwide total has been located.
The combination of data types reported is serious. A Social Security number together with a driver’s license number gives a criminal most of what is needed to attempt new-account fraud, file a false tax return, or pass identity checks with a lender or employer. Medical records add a separate risk, because they can be used for medical identity theft, where someone obtains care or prescriptions in another person’s name, and because they can contain sensitive details that people do not want shared.
Manufacturers are an attractive target for cybercriminals for several reasons. They rely on connected systems to run production, they keep large employee populations on file, and an interruption to operations can create pressure to resolve an incident quickly. Employee data, including benefits and medical paperwork, often sits in human resources and payroll systems that are connected to the wider corporate network.
When a company determines that personal information was accessed without authorization, state and federal laws generally require it to notify the people affected and, depending on the size and nature of the incident, to report it to regulators such as state attorneys general. Notice letters are typically the first reliable source of details about the dates involved, the types of data exposed for each person, and any credit monitoring or identity protection the company is offering.
If you are a current or former ERMCO employee, applicant or family member, watch for a notice by mail and keep it. Consider reviewing your credit reports, checking your health insurance explanation of benefits statements for services you did not receive, and being careful with unexpected calls, texts or emails that refer to your employment or benefits. This page will be updated if ERMCO or a regulator publishes further confirmed details.
When Did This Breach Occur?
The sources available do not state when the ERMCO incident occurred or when it was discovered. The notification appeared in the Massachusetts Attorney General’s listings in early October 2026, and public reports about the filing began circulating on October 2, 2026.
What Information Was Breached?
According to the Massachusetts filing as publicly described, the information that may have been involved includes Social Security numbers, medical records and driver’s license information, along with names and other sensitive information. Which items were involved for any individual has not been published.
What You Can Do
If you are connected to ERMCO, consider these steps:
- Watch your mail for a notice from ERMCO and keep any letter you receive.
- Check your credit reports for free at annualcreditreport.com, and consider a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Review health insurance explanation of benefits statements and medical bills for services you did not receive.
- Be cautious with unexpected calls, texts or emails that mention your employment or benefits, and confirm any request through a phone number you already trust.
- Report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against ERMCO
If you are a current or former ERMCO employee or other individual who received notice about this incident, or believe your information was exposed, you may have legal options. Employers are expected to safeguard sensitive personnel and medical records, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
