Retina Group of Florida data breach: what happened and what to do

Retina Group of Florida is an ophthalmology practice with 22 offices that focuses on diseases of the retina. In September 2025 it reported a data breach to the U.S. Department of Health and Human Services (HHS). The filing lists up to 152,691 people.

What happened

Suspicious activity was flagged on November 9, 2024. The investigation found that an unauthorized person had been in the practice's systems since November 6, 2024, and that patient data may have been copied during that window of about four days.

The slow part came after. Reviewing the affected files to work out whose information was in them took until August 18, 2025. HHS was notified in early September 2025 and the practice began mailing letters on September 16, 2025, almost a year after the intrusion. The long gap matters: if you got a letter this autumn, your data has been out of your hands since late 2024.

What was exposed

The sources used for this page do not list the exact data types, and a practice like this holds patient names, contact details, insurance information and medical records. Each letter says what applies to the person it is addressed to, so read yours for the specific items, in particular whether it mentions a Social Security number.

What this lets criminals do

Even without a Social Security number, a name, address and clinic visit give scammers a good script. Expect calls or texts that claim to come from an eye clinic or insurer, often asking you to confirm details or pay a bill. If a Social Security number or date of birth was included, the larger risk is identity theft: credit accounts, tax refund fraud or loans opened in your name.

The practice's response

Retina Group of Florida offered 12 months of credit monitoring and identity theft protection to the people it notified. Enrollment details are in the letter.

Why the count differs between sources

HHS lists up to 152,691 people. Other regulators' filings can show slightly different totals, because they count people in different ways at different times. This page uses the HHS figure.

What to do with a letter that arrives late

A notice almost a year after the intrusion can look like a scam, and scammers know it. Don't click links in a message that claims to be about this breach. Look up Retina Group of Florida's number yourself, or check the letter against the contact details on the practice's own website, before you share anything.

If you have moved since you were a patient, your letter may have gone to an old address. Ask the practice to confirm what it holds for you and whether you were on the list.

Why health data is hard to take back

You can change a password in a minute. You can't change a medical history, and a Social Security number stays yours for life. A credit freeze blocks new accounts opened with it, and reading your insurance statements catches misuse of your coverage early.

Serus can't remove data from a breach. It watches breach databases and the dark web for your email, phone and other details and alerts you when they show up.