Asheville Eye Associates
Disclosed Jan 17, 20251 year ago327,756 affectedConfirmed
The covered entity (CE), Asheville Eye Associates, PLLC, discovered a ransomware attack and intrusion into its system that affected the protected health information (PHI) of 327,756 individuals. The PHI involved clinical, demographic, and treatment information The CE provided breach notification to the affected individuals, the media, the HHS Secretary, and posted substitute breach notice on its website. In response to the breach, the CE reset all passwords, installed additional endpoint detection measures, increased its monitoring for cyberattacks, and implemented additional cybersecurity training requirements for staff.
What is known
| People affected | 327,756 (as reported to HHS) |
|---|---|
| Disclosed | Jan 17, 2025 |
| Happened | Nov 14, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Vermont Attorney General: 2025-06-13 Asheville Eye Associates Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: Asheville Eye Associatesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Asheville Eye Associates (Healthcare Provider, NC)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Jan 17, 2025 | 327,756 |
| Vermont AGresidents of VT | Jun 13, 2025 | |
| Indiana AGresidents of IN | Jun 13, 2025 | 94 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 147116 to 327756 · backfill source
- 2026-09-25 · disclosed: 2025-06-13 to 2025-01-17 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Asheville Eye Associates, PLLC, discovered a ransomware attack and intrusion into its system that affected the protected health information (PHI) of 327,756 individuals. The PHI involved clinical, demographic, and t · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 147116 · backfill source
- 2026-09-25 · occurred: empty to 2024-11-14 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Vermont AG), confirmed by Vermont AG. Record counts are as reported. Not legal advice.