The letter didn't state how it happened, just when EPMS found out about it on their end and the steps they've taken to rectify the problem. What's disturbing is that the letter just arrived and they claimed to have known about it the entire month of february. Although my friend already monitors their credit, it's still seems a bit unprofessional to wait an entire month to tell someone to take a look at their credit. This is the stuff class action attorneys dream of. I recently received a few grand from one because a doctor's office that I was referred to a few years back threw away paperwork that contained personal information without shredding it. We were told about this and one of the patients took it upon themselves to hire an attorney. There were only around 50 patients affected by this.