20/20 Eye Care Network, Inc.

20/20 Eye Care Network, Inc. notified Montana residents of a data breach discovered on January 11, 2021, where an unauthorized person accessed and deleted health information. Affected data included names and other elements. The company reset passwords, added safeguards, and offered 12 months of credit monitoring.

20/20 Eye Care Network Inc. notified South Carolina residents of a privacy incident on January 11, 2021, where an unauthorized person accessed and deleted health information including names. The company reset passwords, added safeguards, and provided free credit monitoring and fraud assistance to affected individuals.

20/20 Eye Care Network, Inc. experienced unauthorized access to its AWS environment on January 11, 2021, where an unknown party deleted data from S3 buckets. The incident potentially affected 148 New Hampshire residents, exposing PHI including SSNs, names, DOBs, and health insurance info. The company notified the FBI and HHS, engaged forensics, and is offering 12 months of credit monitoring. Investigation is ongoing.

20/20 Eye Care Network, Inc. reported a data breach affecting 221 Maine residents. The breach, which occurred on January 11, 2021, and was discovered on February 18, 2021, was attributed to insider wrongdoing. The compromised information includes names and Social Security numbers. The company notified affected individuals on May 28, 2021, and offered 12 months of credit monitoring and identity restoration services through TransUnion.

20/20 Eye Care Network, Inc reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2021-05-29. 829 Massachusetts residents were affected. The report records the breach type as electronic.

20/20 Hearing Care Network, Inc. reported that an unknown person accessed its system and deleted files on January 11, 2021. The incident potentially exposed Social Security numbers, member IDs, dates of birth, and health insurance information (PHI) of current and former members. The company engaged a cybersecurity firm, reset passwords, and notified the FBI. Affected individuals were offered 12 months of free credit monitoring and fraud assistance.

20/20 Eye Care Network, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2021-05-29. The breach occurred during 1/11/2021 - 1/11/2021. The breach was discovered on 2/18/2021. 3,253,822 individuals were affected. Notice was sent on 5/28/2021.

20/20 Eye Care Network, Inc. reported a cyberattack on Jan 11, 2021, involving unauthorized access to its AWS environment. Data was potentially removed and then deleted. Affected data included names, SSNs, DOBs, and PHI. 690 Washington residents were notified on May 28, 2021. The FBI was notified, and credit monitoring was offered.

20/20 Eye Care Network, Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2021-01-11 and was reported on 2021-05-28. 1,546 Indiana residents were affected. 3,253,822 individuals affected in total.

20/20 Eye Care Network, Inc reported to HHS on 2021-05-24 a Hacking/IT Incident affecting 4,142,440 individuals. Breached information located on Network Server. The cyber-attack affected electronic protected health information (ePHI) including names, addresses, Social Security numbers, and health insurance/claims data. The entity notified HHS, individuals, and media, offered credit monitoring, and strengthened technical safeguards.

20/20 EYE CARE NETWORK, INC filed a data-breach notice with the Illinois Attorney General during 2021 (case 21-198). The register records the breach as discovered on January 11, 2021. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

20/20 EYE CARE NETWORK, INC filed a data-breach notice with the Illinois Attorney General during 2021 (case 21-251). The register records the breach as discovered on January 11, 2021. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.