National Vision Holdings, Inc.

National Vision, Inc. (10-K Item 1C) reports no material cybersecurity incidents in the last three fiscal years. The company describes its cybersecurity risk management program, including a SOC, incident response plan, and third-party vendor risk assessments. Governance is overseen by the CTO and Audit Committee.

National Vision Holdings, Inc. 10-K Item 1C cybersecurity disclosure. As of the filing date, the company reports no cybersecurity threats that have materially affected or are reasonably likely to materially affect the company. The disclosure describes the company's cybersecurity risk management framework, governance structure, and preventive controls including SOC monitoring, MFA, vulnerability management, and HIPAA risk assessments. No specific breach or incident is reported.

Delta Dental of California affiliates reported a data security incident involving the MOVEit file-transfer software. Unauthorized actors exploited a vulnerability between May 27-30, 2023. The company discovered the incident on June 1, 2023, engaged forensic experts, and notified law enforcement. Personal information was acquired. Affected individuals were offered 24 months of identity monitoring via Kroll.

National Vision, Inc reported a data breach to the Indiana Attorney General. 47 Indiana residents were affected. 1,740 individuals affected in total.