Loading story…
EyeMed Vision Care, a major provider of vision care benefits, has agreed to pay $5 million to settle a class action lawsuit stemming from a 2020 phishing email data breach. The breach, which exposed sensitive information, has resulted in EyeMed incurring approximately $12.6 million in total costs, including multiple regulatory fines and settlements with state authorities. As part of the settlement, affected class members are eligible to receive up to $100 for lost time spent responding to the incident, and up to $10,000 for documented, unreimbursed out-of-pocket expenses directly related to the breach. Additionally, an estimated $50 prorated cash payment will be distributed from the remaining funds, with the final amount depending on the number of claims submitted. The settlement allocates $1.6 million, or one-third of the fund, for attorneys' fees, and awards $2,500 to each of the three class representatives. EyeMed has also committed to implementing a series of security enhancements as a condition of the settlement. These measures include stricter authorization requirements for individuals accessing the company’s network, updated internal password reset protocols, and mandatory security awareness training for all employees. The company will also introduce auditing mechanisms to identify weak passwords and strengthen multifactor authentication protocols. Furthermore, EyeMed will reduce the retention period for the email mailbox that was compromised in the breach, aiming to limit future exposure. The breach and subsequent litigation have prompted EyeMed to reevaluate and bolster its cybersecurity posture. Regulatory scrutiny from multiple states has underscored the importance of robust data protection practices in the healthcare sector. The settlement is designed not only to compensate affected individuals but also to drive lasting improvements in EyeMed’s information security framework. The incident highlights the significant financial and reputational risks associated with phishing attacks and inadequate email security. EyeMed’s response demonstrates a commitment to addressing both the immediate and systemic issues revealed by the breach. The case serves as a cautionary example for other organizations handling sensitive health and personal data. By agreeing to these terms, EyeMed aims to restore trust with its customers and regulators while mitigating the risk of similar incidents in the future. The settlement and security upgrades are expected to set a precedent for how healthcare benefit providers respond to large-scale data breaches.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
EyeMed agreed to pay $5 million to settle litigation related to an email breach, according to reports published by BankInfoSecurity and GovInfoSecurity. The two references describe the same settlement development and do not provide an earlier incident date in the supplied content.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several healthcare organizations are resolving class-action litigation tied to alleged exposure of sensitive patient data, with settlements emphasizing cost avoidance rather than admissions of wrongdoing. **Kaiser Permanente** agreed to a **$46 million** settlement over claims that patient interactions with certain Kaiser websites and digital tools resulted in personal health information being transmitted to third parties (including **Google, Microsoft Bing, Twitter/X, and Adobe**) via online tracking/advertising technologies; the allegations focus on web/digital activity rather than Kaiser’s core electronic medical record systems, and the proposed class period spans **2017–2024**. Separately, two healthcare entities reached settlements following **network intrusions** that allegedly exposed protected health information and other sensitive identifiers. **Mystic Valley Elder Services** agreed to pay **$520,000** to settle claims stemming from an **April 2024** incident in which attackers accessed its network and potentially obtained data including SSNs, financial/payment data, credentials, and medical/insurance information affecting **~89,600** people; plaintiffs also alleged delayed detection and notification. **Consulting Radiologists Ltd.** received approval for a **$2.2 million** settlement after a 2024 intrusion affecting up to **583,824** individuals, with allegations including inadequate security controls and delayed breach notification; the organization reported that some impacted records included medical/insurance data and SSNs (for a subset of individuals).
Jun 29, 2026
**General Physician, P.C.** agreed to pay **$2.5 million** to settle consolidated class-action litigation tied to a **2024 email-environment compromise** that exposed sensitive patient data. The organization detected suspicious activity on **June 12, 2024**, and a forensic investigation found an unauthorized party had accessed its email system from **April 6 to June 12, 2024**. Potentially exposed data included **SSNs, financial account information, dates of birth, medical and treatment details, diagnoses, medical record numbers, and insurance information**; the affected population was later updated to **167,387 individuals** (after an initial placeholder report of 501 to HHS OCR). The settlement fund is intended to provide class benefits after fees/expenses, and the company did not admit wrongdoing. Two additional California healthcare providers reported separate security incidents involving unauthorized access to systems containing patient information. **Valley Radiology Consultants Medical Group** identified a breach on **September 15, 2025**, engaged third-party incident response support, confirmed unauthorized access to its network and files, and began mailing notifications after completing file review on **February 18, 2026**; it also offered **12 months of credit monitoring** and reported taking remediation steps (e.g., password changes and security enhancements). **Nephrology Associates Medical Group** separately began notifying patients about a cyberattack first identified on **May 20, 2025** (details in the provided excerpt are truncated), indicating another healthcare-sector intrusion with patient data exposure risk.
Jun 29, 2026
Eastern Radiologists, a North Carolina-based radiology practice, has agreed to pay over $3.4 million to settle consolidated class action litigation following a 2023 data breach that compromised the records of nearly 887,000 patients. The stolen data included sensitive information such as medical diagnoses and treatment details. Under the terms of the settlement, affected individuals can claim up to $5,000 for documented unreimbursed losses, while a $3.2 million common fund will provide pro rata cash payments for undocumented losses. Plaintiff attorneys are expected to claim approximately half of the common fund for fees and expenses. In addition to the financial settlement, Eastern Radiologists has committed to implementing and maintaining changes to its business practices and data security measures. The settlement received preliminary approval from a North Carolina superior court judge, with a final hearing scheduled following the period for objections. The case highlights the significant financial and operational impact of healthcare data breaches and the increasing legal scrutiny on organizations' cybersecurity practices.
Jul 12, 2026