EyeMed Vision Care eyemed.com EyeMed Vision Care data breach: what to do
Phishing emails compromised EyeMed Vision Care employee accounts in June 2020. HHS lists 1,474,000 people affected. Exposed data included names, addresses, birth dates, Social Security numbers, driver's license numbers, diagnoses and medications.
View all 13,177 breaches- Breach date
- 24 Jun 2020
- Affected
- 1,474,000
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Driver's licenses, Diagnoses and conditions, Medications, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
EyeMed Vision Care administers vision benefits for health plans and employers. On June 24, 2020, its employees fell victim to an email phishing attack, and the US Department of Health and Human Services (HHS) lists 1,474,000 people as affected. California and Washington's attorneys general also received notices.
What was exposed
HHS's description says the compromised records included names, addresses, dates of birth, Social Security numbers, driver's license numbers, diagnoses and conditions, medications prescribed, and other treatment information. EyeMed acted as a business associate, meaning it handled the data for the health plans that hired it. It notified HHS, the people affected and the media, and posted a substitute notice.
Why this one calls for a credit freeze
A Social Security number, birth date and driver's license number together are close to a full identity kit. They can be used to open credit, file a false tax return or build a convincing fake ID. The medical details add a second risk: scammers who know a condition or prescription can write messages that sound like your insurer or pharmacy.
The company's response
HHS says EyeMed added administrative, technical and security safeguards after the incident. OCR gave the company technical assistance on the HIPAA Privacy Rule. HHS's entry doesn't mention fines.
If you had vision coverage through a plan that used EyeMed around 2020, look for a notice letter, and ask your plan if you can't find one.
Sources checked: ocrportal.hhs.gov, oag.ca.gov, atg.wa.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit
A credit freeze is free and stops lenders from opening new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Lift it only when you apply for credit yourself.
- 2
Read your health insurance statements
Check explanation of benefits statements and medical bills for care you didn't get. If you see something wrong, call your insurer and the provider's billing office, and report it to the FTC at IdentityTheft.gov.
- 3
Expect messages that mention the breach
Criminals use your name, address and vision plan to make scam emails, texts and calls sound real. Don't click links or call numbers in them. Go to the company's own site, or call the number on your card or statement.
- 4
Replace the driver's license if you see misuse
If your license number is used fraudulently, contact your state's motor vehicle agency and report it at IdentityTheft.gov. Don't replace it just because it was listed.
- 5
Report misuse
If someone opens accounts or files claims in your name, report it at IdentityTheft.gov, the FTC's reporting site, which gives you a recovery plan.
Official filings
- U.S. Department of Health and Human Services , filed 28 Sept 2020 : 1,474,000 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the EyeMed breach?
HHS lists 1,474,000 people. If you had vision benefits through a plan that used EyeMed around 2020, look for a letter, and ask your plan if none arrived.
What was exposed?
Names, addresses, dates of birth, Social Security numbers, driver's license numbers, diagnoses and conditions, medications and other treatment information, per HHS.
How did the breach happen?
HHS says employees were the victims of an email phishing attack.
Should I freeze my credit?
Yes. With a Social Security number and driver's license number in the data, a free credit freeze is the FTC-recommended step.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
