Superior Vision Services
Disclosed Sep 26, 202512 months ago25,341 affectedConfirmed
The business associate (BA), Superior Vision Services, Inc., reported that an employee was the target of an email phishing scheme that affected the protected health information (PHI) of approximately 25,341 individuals. The PHI involved demographic information. The BA notified HHS, affected individuals, and the media. In its mitigation efforts, the BA provided security awareness training to its workforce, strengthened its threat detection and response solutions, and enhanced its access controls to better protect PHI. OCR provided technical assistance to the BA regarding the HIPAA Rules.
What is known
| People affected | 25,341 (as reported by the organization) |
|---|---|
| Disclosed | Sep 26, 2025 |
| Discovered | Jul 11, 2025 |
| Happened | Jul 9, 2025 |
| Attack | Hacking |
| Data exposed | Social Security numbers, Health, Insurance, Dates of birth, Addresses, Names |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Superior Vision Servicesoag.ca.gov · Official notice | Official notice |
| Texas Attorney General data security breach report BR-0004581: Superior Vision Servicesoag.my.site.com · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: Superior Vision Servicesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Superior Vision Services (Business Associate, NY)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Sep 26, 2025 | 328 |
| California AGresidents of CA | Sep 29, 2025 | |
| HHS archivetotal | Sep 29, 2025 | 25,341 |
| Texas AGresidents of TX | Oct 1, 2025 | 3,161 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Superior Vision Services, Inc., reported that an employee was the target of an email phishing scheme that affected the protected health information (PHI) of approximately 25,341 individuals. The PHI involved dem · backfill source
- 2026-09-25 · disclosed: 2025-09-29 to 2025-09-26 · backfill source
- 2026-09-25 · data_types: [] to ["ssn","health","insurance","dob","addresses","names"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 25341 · backfill source
- 2026-09-25 · discovered: empty to 2025-07-11 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.