A ransomware group claims it stole patient records, including names, dates of birth, and detailed eye examination histories, from EnVision Eye Care, a Mississippi ophthalmology practice, after the practice reportedly refused to pay a ransom. EnVision Eye Care has not confirmed the incident. Affected patients should monitor credit reports and watch closely for phishing attempts referencing medical or vision care details.
| Company | EnVision Eye Care |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Patient Names, Dates of Birth, Eye Examination Records, Medical History, Social History Information, OCT Eye Scan Data |
| People Affected | 13,308 patient records |
| Attack Method | Ransomware |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the EnVision Eye Care Data Breach?
A ransomware group has claimed responsibility for stealing a large volume of patient data from EnVision Eye Care, an ophthalmology practice based in Mississippi. The group posted the claim on its dark web leak site, stating that the practice did not pay the demanded ransom. As a result, the attackers say they released the stolen files publicly.
According to the claim, the stolen material includes patient database backups spanning from 2018 through 2025. The attackers also say they obtained a more recent backup from December 2025 containing 13,308 patient records. This timeline suggests the intruders may have had access to EnVision Eye Care’s systems for an extended period before the theft was discovered.
EnVision Eye Care has not publicly confirmed this incident as of this writing. Because this report stems from a ransomware group’s own leak-site posting, the claims remain unverified by the practice itself. No independent forensic confirmation, investigation update, or official statement from EnVision Eye Care has been made available. Readers should treat the scope and details as allegations until the organization responds.
Who was affected?
The individuals potentially affected are patients of EnVision Eye Care who received eye examinations or related ophthalmology services at the practice. Given that the claimed data spans backups from 2018 through 2025, the pool of affected patients could include anyone who visited the practice over that multi-year period.
The ransomware group’s posting states that 13,308 patient records were taken from the December 2025 backup specifically. However, because the attackers also claim to hold the complete backup history going back to 2018, the true number of unique individuals impacted could be different. EnVision Eye Care has not issued its own count, so this figure should be treated as the attacker’s claim rather than a confirmed total.
Because this is a healthcare provider, the affected population likely includes patients of varying ages, potentially including minors who received pediatric eye care. The geographic scope appears centered on Mississippi, reflecting the practice’s local patient base. As the situation develops, more specific details about the affected population may become available.
What Information Was Potentially Exposed?
Based on the ransomware group’s own description of the stolen files, several categories of sensitive health information may have been compromised. This is a claimed, not confirmed, exposure. Still, the nature of the data described is worth understanding clearly.
- Patient names and dates of birth
- Patient database backups covering 2018 through 2025
- Eye examination records including full ocular history
- Medical history details tied to patient records
- Social history information included in exam records
- OCT eye scan archive data
If these claims are accurate, the risk to affected patients could be significant. Medical history and eye examination data are not just private, they are also permanent. Unlike a password, a person’s ocular or medical history cannot be changed after exposure. This means that even years later, this information could still be used to build a fraudulent medical profile or support identity theft schemes.
In addition, combining full names and dates of birth with medical details increases the risk of targeted phishing. Scammers often use real medical details to make fraudulent calls or emails appear legitimate. For example, a scammer referencing an actual eye condition could convincingly pose as a billing department or insurance representative. Because of this, patients should treat any unexpected medical-related contact with caution going forward.
What is the company doing?
EnVision Eye Care has not publicly confirmed this breach, and no statement from the practice has been made available describing an investigation or remediation steps. Since this report originates from a ransomware group’s leak-site claim, it is not yet clear whether the practice has engaged forensic investigators or notified patients directly.
Because no official response has been documented, it is not possible to confirm whether credit monitoring, identity protection services, or formal notification letters have been offered to affected patients. If EnVision Eye Care releases a statement or files a formal notification with a state or federal regulator, that information would typically follow in the weeks after a claim like this surfaces. Patients concerned about their data should watch for direct communication from the practice.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected patients should request a free copy of their credit report from each of the three major credit bureaus. Reviewing these reports regularly can help you spot new accounts or inquiries you did not authorize. Because medical identity theft can sometimes lead to financial fraud, this step remains important even for a healthcare-focused breach.
You can access free weekly credit reports through AnnualCreditReport.com. If you notice any unfamiliar activity, report it to the credit bureau immediately. In addition, consider setting up ongoing credit monitoring, since fraud resulting from stolen medical records can sometimes take months to surface.
Watch for Health-Related Phishing and Fraud
Given the detailed medical nature of the claimed data, patients should be especially alert to phishing attempts that reference eye care, vision insurance, or billing matters. Scammers may use real details from stolen records to make their messages seem credible. Never click links or provide personal information in response to unsolicited calls or emails.
Instead, if you receive a suspicious message claiming to be from EnVision Eye Care or an insurer, contact the practice directly using a verified phone number. This way, you can confirm whether the request is legitimate. Because medical fraud schemes often target older patients or those with chronic conditions, sharing this guidance with family members is also a good idea.
Review Medical Records and Insurance Statements
Patients should request copies of their recent medical records and review them for any unfamiliar entries. This can help reveal whether someone else has used your identity to receive treatment or services. Similarly, carefully review all insurance explanation-of-benefits statements for services you do not recognize.
If you spot anything unusual, report it promptly to both your insurance provider and EnVision Eye Care. Early detection of medical identity theft can prevent further misuse and protect your medical history from becoming inaccurate due to fraudulent entries. This is particularly important for ongoing eye care, where accurate records affect treatment decisions.
Consider a Fraud Alert or Credit Freeze
Because names and dates of birth are among the claimed exposed data, placing a fraud alert on your credit file is a reasonable precaution. A fraud alert requires lenders to take extra steps to verify your identity before issuing new credit. This can slow down identity thieves attempting to open accounts in your name.
For stronger protection, you may also consider a credit freeze, which restricts access to your credit file entirely. While a freeze requires extra steps when you need to apply for credit yourself, it offers one of the most effective defenses against new-account fraud. Both options are typically free to set up with each credit bureau.
Consult a Data Breach Attorney
If you believe you were affected by this incident, speaking with a data breach attorney can help clarify your rights. Many attorneys offer free consultations and can explain whether you may be eligible to join a class action or pursue compensation. This is especially relevant given the sensitive nature of the data reportedly involved.
Because this incident involves unconfirmed claims, legal options may evolve as more facts become available. An attorney experienced in healthcare data breach cases can help you understand potential next steps. Acting early can also help preserve your ability to participate in any future legal action.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.