Eye Care Leaders Facing Class Action Over December 2021 Data Breach [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

Eye Care Leaders faces a proposed class action lawsuit over a December 2021 cyberattack in which “criminal hackers” were able to access the company’s myCare Identity medical record platform.

The 43-page suit says that Eye Care Leaders’ response to the data breach has been “sporadic,” and that the patient management software vendor “still does not appear to have a complete understanding of the full scope” of the incident, which reportedly began around December 4, 2021 and affected at least 348,000 individuals “and likely many more.” 

The complaint pins the incident on Eye Care Leaders’ allegedly “lax data security.” Victims now face an immediate and continuing risk of harm from fraud and identity theft, the case stresses, noting that this is reportedly Eye Care Leaders’ third data breach in less than 10 months. 

Per the lawsuit, the notices sent by defendant ECL Group, LLC to data breach victims have been “piecemeal,” as some impacted clinics were notified of the incident in March 2022 while others “appear to have only recently received the notice.” In fact, the complaint claims, some clinics issued notice to their patients as recently as June 2, 2022, roughly six months after the breach is believed to have occurred. 

According to the lawsuit, Eye Care Leaders, despite being the only entity who knows the scope of the data breach, has not notified victims directly, and instead required its clients to notify their patients that their sensitive data was compromised. 

“The clinics’ notices of the Data Breach, however, appear to have been drafted by Eye Care Leaders, and make clear that Eye Care Leaders, not the clinic, was breached,” the filing stresses. 

The case says patient names, dates of birth, medical record and Social Security numbers, health insurance information and treatment details were exposed to unauthorized access during the Eye Care Leaders data breach. According to the filing, Eye Care Leaders provides services to approximately 9,000 eye care doctors nationwide. 

This is not Eye Care Leaders’ first improper disclosure of patients’ sensitive data, the lawsuit says. In March 2021, the company suffered a ransomware attack that impacted its iMedicWare platform, causing an outage that lasted several days and disrupted clinic practices. Last August, Eye Care Leaders purportedly suffered another attack related to its myCare Integrity platform. Although the company informed clients that it was dealing with “performance” or “system” issues, the platform in reality was hit by a ransomware attack, the lawsuit alleges. 

“Thus, the Data Breach here was Eye Care Leaders’ third data breach in less than ten months,” the suit says. 

The lawsuit looks to cover all persons whose information was compromised in the Eye Care Leaders’ data breach or who were sent notice that their information was compromised in the incident. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.