HackingHealthcareRetail & ConsumerHealthcareBusiness Associate (HIPAA)Customer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumContained

SightCare

bd_e91a5ca72815c0dd · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 12, 2021

Filed

Oct 28, 2022

To disclose

18 months

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for SightCare →

U.S. Vision, Inc., a business associate of Nationwide Optical Group, LLC, experienced unauthorized access to its network between April 20, 2021, and May 17, 2021. The incident was discovered on May 12, 2021. Affected data may include names, dates of birth, addresses, Social Security numbers, driver's license numbers, financial account information, and medical/treatment records. U.S. Vision engaged cybersecurity specialists, conducted a comprehensive file review, and offered credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 12, 2021 → Notified Oct 28, 2022534d ✗ CA 60-day late18 months discovery → filing

Incident timeline

undetected · 22 days

discovery → filing · 18 months / 534 days

Apr 20, 2021

Begins

May 12, 2021

Discovered

Oct 28, 2022

Filed

vs. sector median

+65 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_02aeeb68fb12b11c2022-10-28Verified
Massachusetts State AGbd_48a15e9369b0b8db2022-10-28Verified
Washington State AGbd_50e3bf298757d06a2022-10-28Verified
Oregon State AGbd_887126f96c3367422022-10-28Verified

Name: U.S. Vision, Inc.
norm: u.s. vision
Domain: sightcare.com

Name: SightCare
norm: sightcare
Domain: sightcare.com
Industry: HealthcarellmRetail & Consumerllm

Discovered: May 12, 2021
Breach occurred: Apr 20, 2021 – May 17, 2021
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 28, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via U.S. Vision, Inc.

During the incident: Launched an investigation into the nature and scope of the incident with the assistance of cybersecurity specialists
Instituted dark web monitoring for any potential data that could have been involved in this incident
Conducted a comprehensive review of the impacted files to determine what information was affected and to whom the information related
Offered credit monitoring and identity restoration services for a period of 12/24 months, at no cost
Changes made: Evaluating opportunities to improve security and to better prevent future events of this kind
Enhanced security controls and monitor systems to ensure no similar activity occurs
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 months(534 days from discovery to filing)
Compliance flags: CA 60-day late · 534d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 12, 2021
→ Notified: Oct 28, 2022
534d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 12, 2021 → Notified: Oct 28, 2022	534d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCROct 28 · first

Massachusetts State AGOct 28 · first

Washington State AGOct 28 · first

Oregon State AGOct 28 · first

California State AGOct 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-558717
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 28, 2022
Raw hash: 60ec74acff7535f14ba754705c0dac74e843d798e9953693406f5f99d6025d6c

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityU.S. Vision, Inc.

Victim entitySightCare

Incidentdiscovered May 12, 2021

Stated responseLaunched an investigation into the nature and scope of the incident with the assistance of cybersecurity specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov