Oregon Eye Specialists discloses data breach following employee email compromise

Attackers had access to mailboxes over a two-month period

A US optometry group has disclosed a data breach related to unauthorized activity on internal email accounts.

Oregon Eye Specialists, which runs six clinics throughout Portland, said the exposed data includes customers’ names and one or more of the following: dates of birth, dates of service, medical record numbers, financial account information, and health insurance provider names and/or policy numbers.

After it “identified unusual activity in an email account” on August 10, 2021, the eye-care provider said it “reset account passwords and implemented additional security measures to further protect information”, according to a data breach alert published on October 8.

Catch up with the latest email security news

An investigation then “determined an individual accessed certain accounts between June 29, 2021, and August 31, 2021”, said the company.

It added: “Although we have no evidence to suggest actual or attempted misuse of information as a result of this incident, we are notifying potentially impacted individuals.”

Oregon Eye Specialists is giving potential victims access to credit monitoring and identity protection services, and has urged them to monitor credit reports, financial account statements, and explanation-of-benefits forms for suspicious activity.

The Daily Swig has contacted Oregon Eye Specialists in the hope of ascertaining how many individuals might be affected. We will update the article if and when the company replies.

Eye-opening pattern

Curiously, the incident is at least the fourth data breach to hit the US optometry sector since June.

Most recently, September saw two similar disclosures, with South Jersey eyewear supplier USV Optical reporting (PDF) a data breach affecting 180,000 individuals, while another employee email compromise at Delaware-based Simon Eye potentially had more than 144,000 victims.

The biggest breach of all, in terms of numbers of potential victims, surfaced in June, with Iowan company Wolfe Eye Clinic revealing that a cyber-attack had potentially exposed the personal data of half a million past and present patients, including protected medical information in some cases.

In August there was also a data breach against a Singaporean optometry firm, with more than 73,000 patients potentially affected by a ransomware attack against Eye & Retina Surgeons.