American Vision Partners Data Breach Lawsuit Says Cyberattack Impacted 2.35M People [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

Medical Management Resource Group, which does business as American Vision Partners, faces a proposed class action over a November 2023 cyberattack that compromised the personal data of approximately 2,350,000 people.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 63-page American Vision Partners data breach lawsuit relays that the company, which provides administrative services to ophthalmology practices, discovered unauthorized access to parts of its network on November 14, 2023. Per the suit, a subsequent investigation revealed that a third party had acquired private information that belonged to patients of the defendant’s clients, potentially including names, dates of birth, contact details and certain medical treatment and health insurance data.

The case contends the cyberattack stemmed from American Vision Partners’ failure to implement reasonable data security practices to protect patient information, which was allegedly stored unencrypted and unredacted in the company’s network. As the complaint tells it, the defendant could have prevented the incident had it followed proper encryption protocols or simply deleted the data when it was no longer needed.

In addition, the filing charges that the company’s notification of victims was untimely and lacked critical information about the cyberattack. For instance, the American Vision Partners notice letter did not explain how and when cybercriminals gained access to the network, the dates of the investigation, and what steps are being taken to more effectively safeguard stored information in the future, the data breach lawsuit relays.

“Without these details, [the plaintiff's] and Class Members’ ability to mitigate the harms resulting from the Data Breach is severely diminished,” the suit argues.

According to the complaint, American Vision Partners’ negligence is “exacerbated” by frequent warnings and alerts from cybersecurity experts to properly secure sensitive data against unauthorized acquisition.

In any case, data breach victims now face an ongoing risk of identity theft and fraud as a result of the company’s conduct, the filing asserts.

The lawsuit looks to represent anyone whose personal information was maintained on the computer systems that were compromised in the data breach announced by American Vision Partners in February 2024.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.