Eyemart Express
Disclosed May 12, 20264 months ago189,450 affectedConfirmed
What is known
| People affected | 189,450 (as reported by the organization) |
|---|---|
| Disclosed | May 12, 2026 |
| Discovered | Mar 17, 2026 |
| Happened | Feb 13, 2026 |
| Attack | Hacking |
| Data exposed | Names, Health, Social Security numbers, Insurance, Payment cards, Financial, Dates of birth, Addresses, Government IDs |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Eyemart Expressoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Eyemart Expressatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Eyemart Expressjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report: Eyemart Express (Healthcare Provider, TX)ocrportal.hhs.gov · Official notice | Official notice |
| Texas Attorney General data security breach report BR-0005190: Eyemart Expressoag.my.site.com · Official notice | Official notice |
| Vermont Attorney General breach report: Eyemart Expressago.vermont.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Oregon DOJresidents of OR | May 12 | 250 |
| HHS OCRtotal | May 18 | 25,000 |
| Texas AGresidents of TX | Jul 21 | 45,460 |
| California AGresidents of CA | Jul 24 | |
| Washington AGresidents of WA | Jul 24 | 1,704 |
| Vermont AGresidents of VT | Jul 24 | 1 |
| Oregon DOJresidents of OR | Aug 4 | 2,638 |
History of this record
- 2026-09-25 · source: empty to https://ago.vermont.gov/categories/security-breach-notices · backfill source
- 2026-09-25 · data_types: ["names","health","ssn","insurance","payment-card","financial","dob","addresses"] to ["names","health","ssn","insurance","payment-card","financial","dob","addresses","government-id"] · backfill source
- 2026-09-25 · data_types: ["names","health"] to ["names","health","ssn","insurance","payment-card","financial","dob","addresses"] · backfill source
- 2026-09-25 · records_basis: hhs to organization · backfill source
- 2026-09-25 · records: 25000 to 189450 · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 25000 · backfill source
- 2026-09-25 · disclosed: 2026-07-24 to 2026-05-12 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2026-03-17 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.