It has been discovered that Eye Care Leaders, a supplier of electronic health records and client management software products for eye care clinics, had its databases illegally accessed by cybercriminals on or around December 4, 2021.
Upon obtaining access to the network they hackers logged into the myCare Identity solution and removed databases, systems configuration files, and other data.
Eye Care Leaders have revealed that measures were quickly implemented by the internal incident response team and put an end to the unauthorized activity as soon as the breach was first discovered. Thereafter an official investigation into the security breach was initiated. While the review is still ongoing, breach notification letters have been sent to the ophthalmology and optometry clinics that were impacted by the breach.
To date the investigation has not identified any proof to suggest that the hackers may have accessed or downloaded sensitive data. However, the potential for unauthorized data access and theft taking place could not be 100% eliminated. The range of data that may have been accessed included patient identity, birth dates, medical record details, health insurance data, Social Security information, and details of the treatment(s) administered at affected eye care clinics. The breach was made known to the myCare Identity solution. The databases of any eye care suppliers that use the software remained unimpacted. It is remains unknown the exact amount of patients that may have been impacted by the cyberattack. The Eye Care Leaders online portal claims that the group software has been implemented by more than 9,000 ophthalmologists and optometrists.
Breach notifications have been issued to Nashville-based Summit Eye Associates patients on April 28, 2022. A breach was made known to the HHS’ Office for Civil Rights and is estimated as having impacted as many as 53,818 people. Elsewhere, Kettering, Ohio-based Allied Eye Physicians & Surgeons has reported that the PHI of 20,651 individuals was impacted and Kirkland, Washington-based EvergreenHealth shared breach notification letter to 20,533 patients on April 22, 2022. EvergreenHealth is considering its existing relationship with Eye Care Leaders and auditing the security measures that have been configured at the organization.
In West Virginia Regional Eye Associates, Inc. & Surgical Eye Center of Morgantown revealed that the data of 194,035 patients has been impacted in the cyberattack and a data breach targeting EHRs has also recently been uncovered by Central Vermont Eye Care that impacted 30,000 people. However it is not known if this breach was caused by the Eye Care Leaders cyberattack.