American Vision Partners Settles $1.75M Data Breach Lawsuit Affecting Over 2.2 Million Patients Medical Management Resource Group LLC (MMRC), operating as American Vision Partners, has agreed to a $1.75 million settlement in a class action lawsuit following a 2023 data breach that exposed sensitive patient information. The breach was first detected on November 14, 2023, when suspicious activity was identified in the company’s systems. A forensic investigation confirmed on December 6, 2023, that an unauthorized third party had accessed and exfiltrated files containing patient data. The compromised information included names, contact details, dates of birth, medical records, medications, and, for a subset of individuals, Social Security numbers. The breach was reported to the HHS Office for Civil Rights (OCR) on February 6, 2026, initially affecting 2.35 million individuals, though the figure was later adjusted to 2,264,157. However, the lawsuit cites approximately 1.6 million Americans as impacted. Multiple class action lawsuits were consolidated into a single case Hulewat et al. v. Medical Management Resource Group LLC d/b/a American Vision Partners filed in the U.S. District Court for the District of Arizona. The lawsuit names several co-defendants, including Barnet Dulaney Perkins Eye Center, Southwest Eye Institute, Southwestern Eye Center, and Wellish Vision Institute, though the latter two were later dismissed. Plaintiffs allege that the breach resulted from inadequate cybersecurity measures, including failures to implement industry-standard protections. Claims include negligence, breach of contract, unjust enrichment, and violations of the Arizona Consumer Fraud Act. Under the settlement, a $1.75 million fund will cover attorneys’ fees, administrative costs, and payments to class members. Affected individuals are divided into two subclasses: - Damages Subclass (258,070 individuals) – Those whose Social Security numbers were exposed may claim up to $3,000 for documented losses or a pro rata cash payment. - Injunctive Relief Subclass (all affected individuals) – Will benefit from enhanced cybersecurity measures, including the appointment of a Chief Information Security Officer (CISO) and additional protections valued at $2.79 million. Key deadlines include October 13, 2026, for objections or opt-outs, November 12, 2026, for claim submissions, and a final fairness hearing on December 10, 2026. The settlement awaits final court approval.