Visionworks visionworks.com Visionworks data breach: what happened and what to do
A partially encrypted, decommissioned server from Visionworks' in-store lab in Annapolis, Maryland went missing and was never recovered. Its hard drive held unencrypted health information on about 74,944 people, including demographic, financial and clinical details. Reported to HHS in 2014.
View all 13,177 breaches- Breach date
- 2 Jun 2014
- Affected
- 74,944
- Data exposed
- Demographic information, Financial information, Clinical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Visionworks, the US eyewear and eye care chain, mislaid a decommissioned computer server from its in-store lab in Annapolis, Maryland. The server was partially encrypted and was not recovered. According to the US Department of Health and Human Services (HHS), the hard drive held unencrypted protected health information, with 74,944 people affected in total.
The case was posted on the HHS breach portal in November 2014.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
HHS says the data on the server included demographic, financial and clinical information. Visionworks is a health care provider, so this was patient information, covered by the US health privacy law HIPAA.
This is a lost-hardware case, not a hack. Nothing in the HHS record says anyone used the data. Still, demographic and financial details are what criminals need to open accounts or answer security questions in your name.
What Visionworks did
HHS says Visionworks notified HHS, the affected people and the media, and sent letters to each state Attorney General. It offered one year of free credit monitoring and posted information about the incident on its website. The company then fully encrypted all servers at all of its locations, replaced servers, retrained staff, secured servers with cable locks, took a company-wide server inventory and wrote a system disposal plan.
Who is affected
The record covers patients whose information was held on that server. If you got a letter from Visionworks in 2014, you were included. The free credit monitoring offer has long expired.
What to do if you were in it
- 1
Read any notice you received
If a Visionworks letter reached you in 2014, check what it listed for you. It tells you which kinds of details were on the server.
- 2
Consider a credit freeze
Financial details were on the server. A credit freeze is free and blocks most new accounts in your name. The FTC explains how to place one at Equifax, Experian and TransUnion.
- 3
Read your medical and insurance statements
Look for treatments, claims or bills you don't recognize, and report anything odd to your insurer and the provider.
- 4
Expect phishing that uses real details
Messages that mention your eye exam, your insurer or your address may be scams. Don't click links in unexpected messages; contact the company through a number or site you already know.
- 5
Check whether your email is in this and other breaches
Run a free scan with Serus to see where your email shows up in breach databases. Serus alerts you and tells you what to do. It can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 10 Nov 2014 : 74,944 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Visionworks breach?
HHS lists 74,944 people. If you were a Visionworks patient around 2014 and got a notice letter, you were included.
What was exposed?
HHS describes demographic, financial and clinical information on the server's hard drive. It was unencrypted.
Was the data stolen by hackers?
No. HHS describes a decommissioned server that was mislaid and not recovered, not an attack.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
