20/20 Eye Care Network
Disclosed May 24, 20215 years ago4,142,440 affectedConfirmed
The covered entity (CE), 20/20 Eye Care Network, reported that it experienced a cyber-attack that affected the electronic protected health information (ePHI) of 4,142,440 individuals. The ePHI involved included names, addresses, Social Security numbers, and health insurance and claims information. The CE notified HHS, affected individuals, the media, and provided substitute notice on its website. In its mitigation efforts, the CE offered complimentary credit monitoring services and strengthened its technical safeguards to better protect its PHI.
What is known
| People affected | 4,142,440 (as reported to HHS) |
|---|---|
| Disclosed | May 24, 2021 |
| Discovered | Jan 11, 2021 |
| Happened | Jan 11, 2021 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: 20/20 Eye Care Networkoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: 20/20 Eye Care Networkatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: 20/20 Eye Care Networkjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2021 data breach report: 20/20 Eye Care Networkin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): 20/20 Eye Care Network (Business Associate, FL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | May 24, 2021 | 4,142,440 |
| Washington AGresidents of WA | May 28, 2021 | 690 |
| Indiana AGresidents of IN | May 28, 2021 | 1,546 |
| California AGresidents of CA | May 29, 2021 | |
| Oregon DOJresidents of OR | May 29, 2021 | 3,253,822 |
History of this record
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 3253822 to 4142440 · backfill source
- 2026-09-25 · disclosed: 2021-05-28 to 2021-05-24 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), 20/20 Eye Care Network, reported that it experienced a cyber-attack that affected the electronic protected health information (ePHI) of 4,142,440 individuals. The ePHI involved included names, addresses, Social Secu · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 3253822 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · disclosed: 2021-05-29 to 2021-05-28 · backfill source
- 2026-09-25 · discovered: empty to 2021-01-11 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.