Luxottica data breach exposes 820K EyeMed, LensCrafters patients

11/12/20 update below. This post was originally published on November 7th.

A Luxottica data breach has exposed the personal and protected health information of 829,454 patients at LensCrafters, Target Optical, EyeMed, and other eye care practices.

Luxottica is the world's largest eyewear company with a portfolio of well-known eyeglass brands, including Ray-Ban, Oakley, Oliver Peoples, Ferrari, Michael Kors, Bulgari, Armani, Prada, Chanel, and Coach.

In addition to selling eyeglasses, Luxottica also operates the EyeMed vision benefits company and partners with eye care professionals as part of their LensCrafters, Target Optical, EyeMed, and Pearle Vision retail outlets.

These partners get access to a web-based appointment scheduling application that allows patients to schedule appointments online or over the phone.

Data breach in the appointment scheduling system

In a "Security Incident" notification issued this week, Luxottica disclosed that their appointment scheduling application suffered a data breach after being hacked on August 5th, 2020.

Luxottica states that they first learned about this breach on August 9 and, after investigating the attack, determined on August 28 that the attacker gained access to patients' personal information.

"On August 9, 2020, Luxottica learned of the incident, contained it, and immediately began an investigation to determine the extent of the incident. On August 28, 2020, we preliminarily concluded that the attacker may have accessed and acquired patient information," the Luxottica data breach notification states.

The exposed information includes personal data (PII) and protected health information (PHI), including medical conditions and history.

"The personal information involved in this incident may have included: full name, contact information, appointment date and time, health insurance policy number, and doctor or appointment notes that may indicate information related to eye care treatment, such as prescriptions, health conditions or procedures," Luxottica warned.

For some patients, credit card numbers and social security numbers were also exposed.

If a patient had their payment information and SSNs exposed, Luxottica offers a free two-year identity monitoring service through Kroll.

Luxottica is not aware of any misuse of the accessed data but advises all patients to watch out for notices from their health insurers or health care providers and monitor their credit statements and history for fraudulent activity.

"We recommend that all potentially impacted individuals take steps to protect themselves, for example by closely monitoring notices from your health insurer and health care providers for unexpected activity. If your payment card information and/or Social Security number were involved in this incident, this is explicitly stated in your letter," Luxottica advised on a web site created specifically for this data breach.

On October 27th, Luxottica has begun to mail notices to those who are affected. They have also started releasing press releases on websites for local newspapers to alert patients of the data breach.

Update 11/12/20: A new notification filed with the U.S. Department of Health and Human Services indicates that this breach affected 829,454 patients and is classified as a "Hacking/IT Incident."

All affected users should have been notified via email at this point. If you have not been notified and are concerned your information was exposed, you can contact Luxottica at (877) 540-1431.

All affected users should have been This data breach comes on the heels of a recent Nefilim ransomware attack on Luxottica that occurred on September 18th, 2020, and caused significant outages, interruptions, and theft of unencrypted files.