Oregon Health Plans and Massachusetts Eye Clinic Report Separate Data Breaches Linked to Potential Fraud Two healthcare organizations CareOregon and Health Share of Oregon, along with Andover Eye Associates in Massachusetts have disclosed data breaches involving unauthorized access to patient information, with potential ties to insurance fraud. ### CareOregon and Health Share of Oregon On October 27, 2025, the Oregon-based health plans discovered unauthorized access to protected health information (PHI) of an undisclosed number of patients. The breach exposed names, dates of birth, health plan details, Medicaid/Medicare numbers, and primary care provider information, though Social Security numbers and financial data were not accessed. While the notice did not specify whether the breach was internal or external, the organizations warned of possible fraudulent insurance claims using the compromised data. Affected individuals were advised to review any unexpected billing notices, as legitimate claims would not result in out-of-pocket charges. Law enforcement was notified, and security measures including staff retraining and access restrictions were implemented to prevent further incidents. No breach report has been filed with the HHS Office for Civil Rights as of yet. ### Andover Eye Associates Separately, Andover Eye Associates detected suspicious activity in two employee email accounts on June 10, 2025, later confirming that an unauthorized third party accessed them on May 28, 2025. The breach affected 1,638 patients, exposing names and Social Security numbers. Following an investigation, the clinic mailed notifications on November 4, 2025, offering 12 months of complimentary credit monitoring to impacted individuals. Additional security measures, including enhanced email safeguards and staff training, were put in place to mitigate future risks. Both incidents highlight ongoing vulnerabilities in healthcare data security, with potential consequences for patient privacy and fraud exposure.

Andover Eye Associates Reports Data Breach Affecting Thousands, Including 237 New Hampshire Residents Andover Eye Associates, a multi-specialty ophthalmic practice based in Andover, Massachusetts, disclosed a data breach on December 31, 2025, impacting potentially thousands of individuals across the U.S., with at least 237 confirmed cases in New Hampshire. The breach involved unauthorized access to sensitive personal information, including names and Social Security numbers—key details that heighten the risk of identity theft. The incident came to light on June 10, 2025, when the organization detected suspicious activity in two employee email accounts. An investigation revealed that an unauthorized actor had accessed at least one of the accounts as early as May 28, 2025. By November 4, 2025, the company confirmed the exposure of personally identifiable information (PII). While the exact attack method remains undisclosed, the compromise of Social Security numbers underscores the severity of the breach. Andover Eye Associates reported the incident to the New Hampshire Attorney General’s office and began notifying affected individuals via mail. In response, the organization has enhanced its cybersecurity measures and is offering one year of credit monitoring services through Epiq Global to impacted parties. No further details on the breach’s origin or the number of total affected individuals have been publicly released.