Luxottica of America luxottica.com Luxottica of America data breach: what happened and what to do
Luxottica of America reported that hackers broke into its eye care appointment scheduling app on August 5, 2020. 829,454 people were affected. Names, contact details, appointment notes and insurance policy numbers were exposed, and for some people, card or Social Security numbers.
View all 13,177 breaches- Breach date
- 5 Aug 2020
- Made public
- 27 Oct 2020
- Affected
- 829,454
- Data exposed
- Names, Phone numbers, Physical addresses, Dates of birth, Health insurance information, Social security numbers, Credit cards, Medical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Luxottica of America, the company behind LensCrafters and other eyewear brands, reported a cyberattack on a web-based appointment scheduling application that eye care providers use. The intruder got in on August 5, 2020. Luxottica says it became aware of the attack on August 9 and determined on August 28 that patient information had been accessed. It reported the breach to the U.S. Department of Health and Human Services on October 27, 2020, as a business associate, with 829,454 people affected.
Sources checked: hipaajournal.com, healthitsecurity.com, securityaffairs.com
Last verified against the official page:
What was exposed
Reports on the notice list full names, contact details, appointment dates and times, health insurance policy numbers and appointment notes about eye care. For a smaller group, credit card numbers and Social Security numbers were also exposed. HHS's entry also lists addresses, dates of birth and claims information.
That mix matters. Names plus contact details and an appointment date make phishing that pretends to be an eye clinic or your insurer believable. A Social Security number plus a date of birth is what someone needs to open credit in your name.
The company's response
Luxottica sent notification letters by mail. For people whose payment card or Social Security number was exposed, it offered two years of free identity monitoring through Kroll. It also said it wasn't aware of any misuse of the information. Separately, Luxottica had a ransomware attack in 2020; reporting says that attack was not the cause of this HHS filing.
What to do if you were in it
- 1
Read your notification letter
If you got a letter from Luxottica, check whether it says your Social Security number or card number was involved. That decides how much you need to do. If you were offered free identity monitoring, the FTC says to take it.
- 2
Freeze your credit if your SSN was exposed
A credit freeze is free and stops new accounts being opened in your name. Place it at Equifax, Experian and TransUnion. The FTC explains how at consumer.ftc.gov.
- 3
Watch your insurance and card statements
Read your explanation of benefits and card statements for visits or charges you don't recognize. Report anything odd to your insurer or card issuer right away.
- 4
Expect phishing that mentions your eye care visit
Calls, texts and emails that quote your appointment, doctor or insurer are the likely follow-up. Don't click links in them. Contact the company using a number from your card or its official site.
- 5
Check whether you're in other breaches
Run a free Serus scan to see whether your email or phone number shows up in this and other breaches, and get alerted if it appears in new ones.
Official filings
- U.S. Department of Health and Human Services , filed 27 Oct 2020 : 829,454 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Luxottica breach?
Luxottica said it mailed notification letters to affected patients. If you booked an eye exam through a provider that used its scheduling application in 2020 and got no letter, you can ask the provider or Luxottica.
What data was exposed?
Names, contact information, appointment dates and times, health insurance policy numbers and appointment notes. For some people, credit card numbers and Social Security numbers too.
Is there a settlement?
HIPAA Journal reports Luxottica agreed to settle class action litigation over the breach, with $250,000 set aside for people whose Social Security numbers or financial information were exposed.
Should I freeze my credit?
If your Social Security number was exposed, yes. The FTC recommends a credit freeze or fraud alert in that case, and a freeze is free.
Sources
- hipaajournal.com/luxottica-data-breach-impacts-829454-individuals-in-the-united-states/
- healthitsecurity.com/news/luxottica-data-leaked-by-hackers-after-ransomware-attack-breach
- securityaffairs.com/110565/data-breach/luxottica-lenscrafters-eyemed-data-breach.html
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- atg.wa.gov/data-breach-notifications
- consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alerts
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
Something wrong or out of date? Tell us and we'll re-check it.
