What Happened in the EyeCare Partners Data Breach?
EyeCare Partners, LLC, a major provider in the hospital and health care industry, has confirmed a data breach affecting thousands of patients. The company first detected the incident on Jan. 28, 2025, after noticing suspicious activity in an ECP-managed email account. This discovery prompted an immediate internal review of the company’s email systems.
As a result of that review, EyeCare Partners launched a full investigation and brought in a forensic security firm to determine what happened. The investigation found that an unauthorized third party had accessed multiple ECP-managed email accounts. This access occurred between Dec. 3, 2024, and Jan. 28, 2025, meaning the intrusion went on for nearly two months before it was caught.
Because email accounts can hold years of sensitive attachments and messages, the forensic team needed extensive time to determine exactly what data was involved. The company completed its comprehensive document review on Nov. 11, 2025. Only after this lengthy review could EyeCare Partners determine which categories of personal and health information were actually exposed in the EyeCare Partners data breach.
Importantly, the investigation determined that full medical records and detailed clinical notes were not accessed. However, the compromised accounts still contained enough personal and health-related information to raise serious concerns for affected patients.
Who was affected?
The breach affected patients within the EyeCare Partners network whose information was stored in or referenced by the compromised email accounts. Because the exposure occurred through employee email rather than a single database, the specific information exposed varied from person to person.
According to the notification, the breach affected 17,622 individuals in total, an increase from an earlier reported figure of 17,110. This includes three individuals located in Massachusetts, where the incident was formally disclosed to state regulators. Since EyeCare Partners operates broadly within the healthcare industry, the affected population likely includes patients across multiple locations and age groups, though the source does not specify additional demographic details.
The company also notified the U.S. Department of Health and Human Services, as required for incidents involving protected health information. This step confirms that the breach falls under federal health data breach rules, not just general privacy law.
What Information Was Potentially Exposed?
The information exposed differed by individual, based on what was contained in each affected email account. Still, the notification outlines several categories of data that may have been compromised for at least some patients.
- Full names
- Contact information
- Social Security numbers
- Dates of birth
- Driver’s license or other government identification numbers
- Health plan details
- Limited clinical information
This combination of data is particularly concerning because it blends personally identifiable information with protected health information. For example, a Social Security number paired with a date of birth and government ID number gives criminals nearly everything needed to open new credit accounts. As a result, affected individuals face a real risk of identity theft and financial fraud.
In addition, the exposure of health plan details and limited clinical information creates a separate risk. Criminals sometimes use stolen health plan information to commit medical identity theft, such as filing fraudulent insurance claims. Because of this, patients should watch not only their bank statements but also their insurance and medical billing records for unusual activity.
What is the company doing?
After detecting the suspicious activity, EyeCare Partners quickly secured the compromised email accounts to stop any ongoing unauthorized access. The company then engaged cybersecurity experts to investigate the incident thoroughly and confirm that its broader network remained secure.
Following the investigation, EyeCare Partners reviewed and strengthened its technical security measures. The company also gave employees additional training on how to recognize suspicious emails, aiming to reduce the risk of similar phishing-related intrusions in the future.
For those affected, EyeCare Partners is offering complimentary Single Bureau Credit Monitoring, along with credit report and credit score access, for 24 months through Cyberscout, a TransUnion company. These services include credit file alerts and proactive fraud assistance. Individuals must enroll within 90 days of receiving their notification letter to take advantage of this protection.
The company has also set up a confidential, toll-free inquiry line so affected individuals can ask questions and get more details about the incident directly.
What Should Affected Individuals Do?
Enroll in Free Credit Monitoring
If you received a notification letter from EyeCare Partners, you should enroll in the free credit monitoring service right away. This service can alert you quickly if someone tries to open new accounts in your name.
Because enrollment is only available for 90 days after notification, it’s important not to delay. Missing this window means losing free protection that could otherwise catch fraud early.
Consider a Credit Freeze or Fraud Alert
Since Social Security numbers and driver’s license numbers were among the data potentially exposed, placing a security freeze on your credit files is a smart precaution. A freeze blocks new creditors from accessing your credit report, which makes it much harder for identity thieves to open accounts in your name.
Alternatively, you can place a fraud alert, which requires businesses to verify your identity before extending credit. Both options are free and can be requested directly through each of the three major credit bureaus. As a result, taking this step adds an extra layer of protection while you monitor for other signs of misuse.
Watch for Signs of Medical Identity Theft
Because health plan details and limited clinical information were involved, affected individuals should also monitor their medical and insurance records closely. This means reviewing statements from your health insurer for services you don’t recognize.
In addition, request an explanation of benefits from your insurer periodically to check for unfamiliar claims. If you notice anything suspicious, contact your insurance provider immediately and report the issue as potential medical identity theft.
Stay Alert to Phishing Attempts
Since this breach originated from compromised email accounts, affected individuals should be especially cautious of phishing emails referencing EyeCare Partners or claiming to offer breach-related help. Scammers often use news of a breach to trick victims into revealing more information.
Therefore, avoid clicking links or downloading attachments from unexpected emails, even if they appear to come from a trusted source. Instead, contact EyeCare Partners directly using the toll-free number provided in your official notification letter to verify any communication.
Report Suspicious Activity Promptly
If you notice any signs of identity theft or fraud, report it to local law enforcement and the Federal Trade Commission as soon as possible. Filing a report creates an official record that can help you dispute fraudulent charges later.
Additionally, consider speaking with a data breach attorney for a free case evaluation. This can help you understand whether you qualify for compensation and what steps make sense for your specific situation.
More Information
Official Notice from Eyecare Partners
HHS Office for Civil Rights Breach Notification Portal