MalwareHealthcareHealthcareRansomwareData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Health (basic)Financial accountMediumContained

Aloha Laser Vision

bd_880c37b381e2118f · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 30, 2022

To disclose

—

Affected

39,087state residents only

Linked

2 filings

Confidence

66%

Full breach record for Aloha Laser Vision →

Aloha Laser Vision, LLC, an ophthalmology practice in Honolulu, HI, issued a precautionary notice regarding a 2021 data security incident suffered by its third-party EHR vendor, Eye Care Leaders. The vendor's 'myCare Integrity' platform was accessed and databases deleted. While no evidence suggests patient records were compromised, PHI and PII may have been stored on the system. Kroll identity monitoring is offered.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Dec 4, 2021

Begins

Jun 30, 2022

Filed

This filing is one of 2 about the same incident.View merged incident

Part of Eye Care Leaders supply-chain incident (2022) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_17ed82caad39b6042022-06-17 · +13dVerified

Name: Aloha Laser Vision
norm: aloha laser vision

Name: Aloha Laser Vision
norm: aloha laser vision
Industry: Healthcarellm

Discovered: —
Breach occurred: Dec 4, 2021
Materiality determined: —
Notification sent: —
Affected individuals: 39,087state-resident count only
Data types: Identity (basic)Health (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Third party: via Eye Care Leaders

During the incident: Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Mailing letters to patients whose information was stored on the myCare Integrity solution at the time of the incident
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HI CRA notice due
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJun 17 · first

Hawaii State AG+13d · this page

Pattern: first filing Jun 17 (HI), last Jun 30 (HI) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://cca.hawaii.gov/wp-content/uploads/2026/05/OCP-2022-1195.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 30, 2022
Raw hash: 411dc4aa1c36d4a87cad88e58d20beef08db0ebdec5e4747b3fc79a635cb80e9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAloha Laser Vision

Victim entityAloha Laser Vision

IncidentThird-Party / Supply Chain

Stated responseSecured the services of Kroll to provide identity monitoring at no cost to you for one year

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenancecca.hawaii.gov