Tri-Century Eye Care breach exposes data of about 200,000 patients and employees

Tri-Century Eye Care, a medical and surgical eye care provider operating multiple offices in Bucks County and eastern Pennsylvania, has disclosed a data breach affecting roughly 200,000 individuals, based on information listed in the U.S. Department of Health and Human Services’ breach tracking database.

The organization reported detecting unusual activity within its network on September 3. A subsequent investigation with cybersecurity specialists confirmed by September 19 that an unauthorized party had gained access to internal systems and obtained files containing personal and protected health information. The company stated that its current electronic medical records platform was not compromised during the intrusion.

Information contained in the accessed files varies but may include names, dates of birth, Social Security numbers, medical and health data, treatment and diagnostic details, health insurance information, billing or payment records, and other financial data. The disclosure, published on the provider’s website in late October, notified patients and employees that their data may have been involved.

The Pear ransomware group later claimed responsibility for the attack, asserting that more than three terabytes of information had been stolen, including human resources records, financial and business documents, emails, databases, and both personal and health-related data. The group has since released the files it alleges were taken from the provider, indicating that the organization declined to meet ransom demands.

Healthcare data breaches frequently affect large populations due to the breadth of information maintained by medical providers. Tri-Century Eye Care is one of several vision care organizations to report significant breaches this year, alongside Retina Group of Florida, Asheville Eye Associates, and Ocuco.

Attorneys working with ClassAction.org are evaluating whether a class action lawsuit may be pursued in response to the incident. As part of that review, the legal team is seeking to hear from individuals who received notice of the breach or believe their information was exposed.

Tri-Century Eye Care has stated that its investigation into the incident is continuing and that affected individuals are being notified in accordance with federal and state requirements.