Spectrum Eye Physicians spectrumeye.com Spectrum Eye Physicians data breach: what happened and what to do
A cyberattack on Spectrum Eye Physicians' electronic records vendor, Eye Care Leaders, on December 4, 2021 affected about 175,000 patients, according to the practice's report to HHS. Names, dates of birth, Social Security numbers and treatment details were involved.
View all 13,177 breaches- Breach date
- 4 Dec 2021
- Made public
- 6 Jun 2022
- Affected
- 175,000
- Data exposed
- Names, Dates of birth, Social security numbers, Physical addresses, Phone numbers, Health insurance information, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Spectrum Eye Physicians, a California eye-care practice, told patients about two separate incidents, both at its software vendor Eye Care Leaders (ECL). It reported the larger one to the US Department of Health and Human Services as affecting 175,000 people.
What happened
On December 4, 2021, an attacker got full access to ECL's myCare Integrity records system, which runs on Amazon Web Services, and deleted databases and configuration files. ECL spotted the activity within a day and restored many databases from backups. It couldn't say which patient records the attacker had seen, so it told Spectrum to assume all records in the system were affected. Spectrum received that notice on March 1, 2022.
The second incident was a flaw in the payment portal run by ECL's billing arm, Alta. By changing a web address, someone could view other patients' payment receipts. A Spectrum patient had noticed it in October 2021, and Spectrum reported it to Alta on October 26, 2021. Alta confirmed the scope to Spectrum on May 19, 2022.
Sources checked: oag.ca.gov, ocrportal.hhs.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
For the portal, the receipts could show a patient's name, email address, the amount paid, and the last four digits of the card or bank account used. For the records system, HHS's summary of the report lists names, dates of birth, Social Security numbers, addresses, phone numbers, diagnoses, medications, health insurance and other treatment information.
That mix is what identity thieves and scammers look for. A Social Security number and date of birth can be used to open credit in your name, and medical details make a fake call from your insurer or clinic more believable.
What Spectrum did
Spectrum notified patients, the media and HHS, and said it would end its contracts with ECL and Alta and move patient data to other vendors. Its letter recommended placing a fraud alert with the credit bureaus.
What to do if you were in it
- 1
Freeze your credit if identity data was involved
If a Social Security number or date of birth was exposed, place a free credit freeze at Equifax, Experian and TransUnion, as the FTC describes. Then check your reports at annualcreditreport.com.
- 2
Consider a fraud alert
The letter recommends a fraud alert. Per the FTC, an initial alert is free, lasts one year, and you only contact one bureau, which tells the other two.
- 3
Read your insurance statements
Check explanation of benefits statements and bills for care you didn't receive, and tell your insurer or provider if something looks wrong.
- 4
Expect messages that mention the breach
Don't click links in emails or texts about the breach or offering help with it. Go to the organization's site yourself or call the number on your own records.
- 5
Check which other breaches include your details
Run a free Serus scan to see whether your email or phone appears in this or other breaches. Serus can't remove breach data, but it alerts you when your details turn up so you know when to act.
- 6
Report misuse
If someone opens accounts or files claims in your name, report it at IdentityTheft.gov to get a recovery plan.
Official filings
- U.S. Department of Health and Human Services , filed 6 Jun 2022 : 175,000 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Spectrum Eye Physicians breach?
Spectrum said it notified every patient whose records were in the affected systems. If you were a patient and got a letter, you were included. If you're unsure, contact the practice directly.
What was exposed?
Payment receipts could show names, email addresses and the last four digits of a card or bank account. HHS's summary of the larger report also lists Social Security numbers, dates of birth, diagnoses, medications and health insurance details.
Was the data confirmed stolen?
Not for certain. The vendor couldn't rule out that the records were accessed, so Spectrum treated it as a breach and notified patients.
Should I freeze my credit?
If your Social Security number or date of birth was involved, yes. A freeze is free and can be lifted any time.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
