Tri Century Eye Care tricenturyeye.com Tri Century Eye Care data breach: what happened and what to do
Tri Century Eye Care, a Pennsylvania eye care practice, reported a network breach to HHS on October 31, 2025, affecting about 200,000 patients and employees. Files may have included names, dates of birth, Social Security numbers, medical and insurance details and payment information.
View all 13,115 breaches- Breach date
- 3 Sept 2025
- Made public
- 31 Oct 2025
- Affected
- 200,000
- Data exposed
- Names, Dates of birth, Social security numbers, Medical information, Health insurance information, Financial information
- Last updated
What happened
Tri Century Eye Care, an ophthalmology practice in Bucks County, Pennsylvania, said it detected unusual activity in its network on September 3, 2025. Its investigation confirmed by September 19 that an unauthorized party had gained access to internal systems. The practice reported the incident to HHS on October 31, 2025, with about 200,000 people affected, a count that covers patients and employees. News coverage says a ransomware group claimed the attack, and that the practice did not pay. The practice says its electronic medical records system was not hacked.
What was exposed
According to the notice as reported by SecurityWeek and HIPAA Journal, files accessed could include names, dates of birth, Social Security numbers, medical and treatment information, insurance details and payment or financial records. Exactly what was exposed depends on whether you were a patient or an employee.
A Social Security number with a date of birth is enough to apply for credit in your name. Treatment and insurance details can be used for medical identity theft or for phone scams that sound like your eye doctor's office.
The practice's response
Tri Century Eye Care notified HHS and the FBI. It says it added stronger password requirements, reduced access permissions and moved older data offline.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion. It stops lenders from opening new accounts in your name, and you can lift it whenever you need credit yourself.
- 2
Use any free monitoring offered
If you got a notice letter, check whether it includes credit monitoring or identity protection and sign up before the code expires.
- 3
Review insurance statements
Read each explanation of benefits and question any visit or treatment you don't recognize.
- 4
Treat calls and emails about this breach as suspect
Scammers use real breach details to sound credible. Contact the practice using a number you look up yourself.
- 5
Check whether your details are in other breaches
Run a free Serus scan to see whether your email or phone number appears in this or other breaches. Serus monitors breach databases and the dark web and alerts you, but it can't remove data that has already leaked.
Frequently asked
Was I affected by the Tri Century Eye Care data breach?
The practice notified people it identified, patients and employees alike. If you used the practice and got no notice, contact it to ask.
What was exposed in the breach?
Files may have included names, dates of birth, Social Security numbers, medical and treatment information, insurance details and financial records. It varies by person.
How many people were affected?
The practice reported about 200,000 people to HHS.
Should I freeze my credit?
If you got a notice saying your Social Security number was involved, yes. A freeze is free and easy to lift.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
