EVC
Company Details
Linkedin ID:
eyemed-vision-care
Website:
Employees number:
618
Number of followers:
17,596
NAICS:
524
Industry Type:
Homepage:
eyemed.com
IP Addresses:
0
Company ID:
EYE_4290134
Scan Status:
In-progress
EyeMed Vision Care Company CyberSecurity Posture
eyemed.com
EyeMed Vision Care is a leader in vision insurance benefits. We deliver stand-out vision benefits centered around an outstanding member experience. EyeMed boasts America’s largest vision network with a diverse network of independent ODs, retail and online providers. No wonder 99% of clients agree we deliver value, that’s why nearly 98% of EyeMed members use their benefits in network. EyeMed is a Top-Tier Partner of the OneSight EssilorLuxottica foundation, a registered charitable organization that helps create access to vision care for people in need globally. EyeMed is based in Cincinnati, Ohio. Learn more at eyemed.com
EyeMed Vision Care A.I CyberSecurity Scoring
EVC Risk Score (AI oriented)Between 700 and 749
EVC
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
EVC Global Score (TPRM)XXXX
EVC
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
EVC Company CyberSecurity News & History
Past Incidents
1
Attack Types
1
EyeMed Vision Care
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: In 2020, EyeMed Vision Care suffered a phishing email breach where hackers accessed a shared inbox used by nine employees for enrollment processing. The compromised email, protected only by a weak password, contained six years of sensitive customer data, including personal and potentially financial information. The breach impacted up to 2.1 million individuals nationwide, though the class action settlement covered ~692,154 members. Regulatory fines and settlements have cost EyeMed over $12.6 million, including a $5M class action payout, $4.5M to New York’s DFS, $600K to the NY AG, and $2.5M to four other states. The company also faced mandatory security upgrades, including MFA enhancements, password audits, HIPAA risk assessments, and reduced email retention periods. The breach exposed customers to potential fraud, identity theft, and financial losses, with class members eligible for compensation up to $10,000 for documented damages. EyeMed denied wrongdoing but agreed to settlements to resolve negligence and compliance violation claims.
EVC Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for EVC
Incidents vs Insurance Industry Average (This Year)
No incidents recorded for EyeMed Vision Care in 2026.
Incidents vs All-Companies Average (This Year)
No incidents recorded for EyeMed Vision Care in 2026.
Incident Types EVC vs Insurance Industry Avg (This Year)
No incidents recorded for EyeMed Vision Care in 2026.
Incident History — EVC (X = Date, Y = Severity)
EVC cyber incidents detection timeline including parent company and subsidiaries
EVC Company Subsidiaries
EyeMed Vision Care is a leader in vision insurance benefits. We deliver stand-out vision benefits centered around an outstanding member experience. EyeMed boasts America’s largest vision network with a diverse network of independent ODs, retail and online providers. No wonder 99% of clients agree we deliver value, that’s why nearly 98% of EyeMed members use their benefits in network. EyeMed is a Top-Tier Partner of the OneSight EssilorLuxottica foundation, a registered charitable organization that helps create access to vision care for people in need globally. EyeMed is based in Cincinnati, Ohio. Learn more at eyemed.com
Loading...
EVC Similar Companies
AIA Group Limited and its subsidiaries (collectively “AIA” or the “Group”) comprise the largest independent publicly listed pan-Asian life insurance group. It has a presence in 18 markets – wholly-owned branches and subsidiaries in Mainland China, Hong Kong SAR(1), Thailand, Singapore, Malaysia, Aus
CNO Financial Group
CNO Financial Group, Inc. (NYSE: CNO) secures the future of middle-income America. CNO provides life and health insurance, annuities, financial services, and workforce benefits solutions through our family of brands, including Bankers Life, Colonial Penn, Optavise and Washington National. Our cus
Humana will never ask, nor require a candidate to provide money for work equipment and network access during the application process. If you become aware of any instances where you as a candidate are asked to provide information and do not believe it is a legitimate request from Humana or affiliate,
Sedgwick is the world’s leading risk and claims administration partner, helping clients thrive by navigating the unexpected. The company’s expertise, combined with the most advanced AI-enabled technology available, sets the standard for solutions in claims administration, loss adjusting, benefits ad
Progressive Insurance
Every journey has a beginning, and wherever you are on your career path, we want to help you along the way. At Progressive, we exist to help people move forward and live fully. We strive to create a welcoming and flexible work environment for everyone, where employees are encouraged to risk, learn,
SBI Life Insurance (‘SBI Life’ / ‘The Company’), one of the most trusted life insurance companies in India, was incorporated in October 2000 and is registered with the Insurance Regulatory and Development Authority of India (IRDAI) in March 2001. Serving millions of families across India, SBI Li
Travelers
Travelers provides insurance coverage to protect the things that are important to you – your home, your car, your valuables and your business. We have been around for more than 170 years and have earned a reputation as one of the best property casualty insurers in the industry because we take care o
Sunshine Insurance Group
Established in July 2005, Sunshine Insurance Group has experienced sustainable development, now ranking among the Top 7 insurance groups in China, with an annual business income of $12.6 billion in 2016. Sunshine is composed of Property and Casualty Insurance, Life Insurance, Credit and Guarantee In
Blue Cross Blue Shield of Michigan
Blue Cross Blue Shield of Michigan is a nonprofit corporation and an independent licensee of the Blue Cross and Blue Shield Association. BCBSM's commitment to Michigan is what differentiates it from other health insurance companies doing business in the state. That mission has never changed. Nea
.png)
EVC CyberSecurity News
October 06, 2025 07:00 AM
EyeMed Vision Care Agrees to Pay $5 Million to Settle Class Action Data Breach Lawsuit
EyeMed Vision Care has agreed to pay $5 million to settle a class action lawsuit stemming from a June 2020 data breach.
October 02, 2025 07:00 AM
EyeMed Vison Care agrees to settle data breach class action for $5M
Individuals who received a notice about the EyeMed Vision Care data breach may be eligible to claim up to $10000 from a class action...
August 18, 2025 07:00 AM
State reaches $2M settlement with dental insurer over cybersecurity violations
The state has reached a settlement with a major dental insurance provider over what the state claimed was shoddy cybersecurity that exposed...
October 11, 2024 07:00 AM
2024 Cyber Litigation Legal Update – What Your Business Needs To Know
This Legal Update discusses recent cyber-litigation trends, notable data breach class-action litigation, and considerations for protecting privilege during a...
May 18, 2023 07:00 AM
EyeMed Vision Care Reaches $2.5M Settlement Over Multistate Data Breach
Vision insurer EyeMed Vision Care reached a $2.5 million settlement following a 2020 data breach that impacted 2.1 million individuals.
May 17, 2023 07:00 AM
EyeMed Vision Care Settles Multistate Data Breach Investigation for $2.5 Million
In June 2020, the Luxottica Group PIVA-owned vision insurance company, EyeMed Vision Care, experienced a data breach involving the protected...
November 09, 2022 08:00 AM
New York Department of Financial Services' EyeMed Settlement Emphasizes Risk Assessments, Email Controls
The New York Department of Financial Services' settlement with EyeMed emphasizes the importance of cybersecurity risk assessments.
October 20, 2022 06:53 PM
EyeMed fined $4.5M following data breach
EyeMed Vision Care LLC will pay $4.5M to the New York Department of Financial Services (DFS) to settle claims it breached state cybersecurity rules before a...
February 08, 2022 08:00 AM
New York SHIELD Act $600,000 settlement
The New York Attorney General (AG) announced a settlement with vision-benefits-provider EyeMed Vision Care, Inc., relating to a 2020 security incident.
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
EVC CyberSecurity History Information
Official Website of EyeMed Vision Care
The official website of EyeMed Vision Care is http://www.eyemed.com.
EyeMed Vision Care’s AI-Generated Cybersecurity Score
According to Rankiteo, EyeMed Vision Care’s AI-generated cybersecurity score is 700, reflecting their Moderate security posture.
How many security badges does EyeMed Vision Care’ have ?
According to Rankiteo, EyeMed Vision Care currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Has EyeMed Vision Care been affected by any supply chain cyber incidents ?
According to Rankiteo, EyeMed Vision Care has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.
Does EyeMed Vision Care have SOC 2 Type 1 certification ?
According to Rankiteo, EyeMed Vision Care is not certified under SOC 2 Type 1.
Does EyeMed Vision Care have SOC 2 Type 2 certification ?
According to Rankiteo, EyeMed Vision Care does not hold a SOC 2 Type 2 certification.
Does EyeMed Vision Care comply with GDPR ?
According to Rankiteo, EyeMed Vision Care is not listed as GDPR compliant.
Does EyeMed Vision Care have PCI DSS certification ?
According to Rankiteo, EyeMed Vision Care does not currently maintain PCI DSS compliance.
Does EyeMed Vision Care comply with HIPAA ?
According to Rankiteo, EyeMed Vision Care is not compliant with HIPAA regulations.
Does EyeMed Vision Care have ISO 27001 certification ?
According to Rankiteo,EyeMed Vision Care is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of EyeMed Vision Care
EyeMed Vision Care operates primarily in the Insurance industry.
Number of Employees at EyeMed Vision Care
EyeMed Vision Care employs approximately 618 people worldwide.
Subsidiaries Owned by EyeMed Vision Care
EyeMed Vision Care presently has no subsidiaries across any sectors.
EyeMed Vision Care’s LinkedIn Followers
EyeMed Vision Care’s official LinkedIn profile has approximately 17,596 followers.
NAICS Classification of EyeMed Vision Care
EyeMed Vision Care is classified under the NAICS code 524, which corresponds to Insurance Carriers and Related Activities.
EyeMed Vision Care’s Presence on Crunchbase
No, EyeMed Vision Care does not have a profile on Crunchbase.
EyeMed Vision Care’s Presence on LinkedIn
Yes, EyeMed Vision Care maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/eyemed-vision-care.
Cybersecurity Incidents Involving EyeMed Vision Care
As of January 24, 2026, Rankiteo reports that EyeMed Vision Care has experienced 1 cybersecurity incidents.
Number of Peer and Competitor Companies
EyeMed Vision Care has an estimated 15,155 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at EyeMed Vision Care ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach.
What was the total financial impact of these incidents on EyeMed Vision Care ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $12.60 million.
How does EyeMed Vision Care detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes (post-breach), and third party assistance with yes (third-party hipaa security risk assessment), and containment measures with shortened email retention period, containment measures with enhanced mfa, containment measures with password policy updates, and remediation measures with security awareness training, remediation measures with audit mechanisms for weak passwords, remediation measures with third-party risk assessment, and communication strategy with class-action settlement notifications, communication strategy with regulatory disclosures (hhs, state ags)..
Incident Details
Can you provide details on each incident ?
Title: EyeMed Email Breach Settlement
Description: Vision care benefits firm EyeMed agreed to pay $5 million to settle class action litigation involving a 2020 phishing email data breach. The incident, which exposed sensitive customer data from a shared email inbox, has already cost the company over $12.6 million in regulatory fines and settlements across multiple states. The breach affected up to 2.1 million consumers nationwide, with 692,154 class members identified in the settlement. Security improvements mandated include enhanced MFA, password policies, HIPAA risk assessments, and third-party audits.
Date Detected: 2020-09
Date Publicly Disclosed: 2020-09
Type: Data Breach
Attack Vector: Phishing (compromised shared email inbox with weak password)
Vulnerability Exploited: Weak PasswordLack of MFAProlonged Email Retention (6+ years)Shared Inbox Access
Motivation: Financial Gain (data exfiltration for fraud/identity theft)
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Phishing email (compromised shared inbox).
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach EYE4802448100725
Financial Loss: $12.6M+ (regulatory fines, settlements, and litigation costs)
Data Compromised: Personal data, Sensitive customer information
Systems Affected: Shared Employee Email Inbox (enrollment processing)
Brand Reputation Impact: High (multiple regulatory actions and class-action lawsuit)
Legal Liabilities: $12.6M+ (fines: $4.5M NY DFS, $600K NY AG, $2.5M 4-state AG, $5M class-action)
Identity Theft Risk: High (personal data exposed)
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $12.60 million.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personal Data, Enrollment Information, Sensitive Customer Records and .
Which entities were affected by each incident ?
Incident : Data Breach EYE4802448100725
Entity Name: EyeMed Vision Care
Entity Type: Healthcare (Vision Care Benefits Provider)
Industry: Healthcare
Location: Ohio, USA
Customers Affected: 2.1 million (nationwide); 692,154 (class members); 1.47 million (HHS report); 98,632 (New York residents)
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach EYE4802448100725
Incident Response Plan Activated: Yes (post-breach)
Third Party Assistance: Yes (third-party HIPAA security risk assessment)
Containment Measures: Shortened email retention periodEnhanced MFAPassword policy updates
Remediation Measures: Security awareness trainingAudit mechanisms for weak passwordsThird-party risk assessment
Communication Strategy: Class-action settlement notificationsRegulatory disclosures (HHS, state AGs)
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Yes (post-breach).
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Yes (third-party HIPAA security risk assessment).
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach EYE4802448100725
Type of Data Compromised: Personal data, Enrollment information, Sensitive customer records
Number of Records Exposed: 2.1 million (max estimate)
Sensitivity of Data: High (6+ years of customer data)
Data Exfiltration: Yes
Data Encryption: No (data stored in unencrypted email inbox)
File Types Exposed: EmailsAttachments (enrollment documents)
Personally Identifiable Information: Yes
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Security awareness training, Audit mechanisms for weak passwords, Third-party risk assessment, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by shortened email retention period, enhanced mfa, password policy updates and .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach EYE4802448100725
Regulations Violated: HIPAA, California State Laws (e.g., CCPA), New York Financial Services Law (23 NYCRR 500),
Fines Imposed: $12.6M+ ($4.5M NY DFS, $600K NY AG, $2.5M 4-state AG, $5M class-action)
Legal Actions: Class-action lawsuit (settled 2026-01-07), NY DFS Consent Order (2022-10), NY AG Settlement (2022-01), 4-State AG Settlement (2023-05),
Regulatory Notifications: HHS (2020-09)State AGs (NY, NJ, FL, PA, OR)
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Class-action lawsuit (settled 2026-01-07), NY DFS Consent Order (2022-10), NY AG Settlement (2022-01), 4-State AG Settlement (2023-05), .
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Data Breach EYE4802448100725
Lessons Learned: Shared inboxes with weak passwords are high-risk targets for phishing., Prolonged data retention increases exposure in breaches., MFA and password policies must be enforced rigorously in healthcare., Regulatory non-compliance (e.g., HIPAA) amplifies financial and reputational damage.
What recommendations were made to prevent future incidents ?
Incident : Data Breach EYE4802448100725
Recommendations: Implement strict MFA for all email accounts, especially shared inboxes., Enforce password complexity and rotation policies with audits., Limit data retention periods to minimize breach impact., Conduct regular HIPAA security risk assessments with third-party auditors., Segment networks to isolate sensitive data (e.g., enrollment systems)., Train employees on phishing awareness and incident reporting.Implement strict MFA for all email accounts, especially shared inboxes., Enforce password complexity and rotation policies with audits., Limit data retention periods to minimize breach impact., Conduct regular HIPAA security risk assessments with third-party auditors., Segment networks to isolate sensitive data (e.g., enrollment systems)., Train employees on phishing awareness and incident reporting.Implement strict MFA for all email accounts, especially shared inboxes., Enforce password complexity and rotation policies with audits., Limit data retention periods to minimize breach impact., Conduct regular HIPAA security risk assessments with third-party auditors., Segment networks to isolate sensitive data (e.g., enrollment systems)., Train employees on phishing awareness and incident reporting.Implement strict MFA for all email accounts, especially shared inboxes., Enforce password complexity and rotation policies with audits., Limit data retention periods to minimize breach impact., Conduct regular HIPAA security risk assessments with third-party auditors., Segment networks to isolate sensitive data (e.g., enrollment systems)., Train employees on phishing awareness and incident reporting.Implement strict MFA for all email accounts, especially shared inboxes., Enforce password complexity and rotation policies with audits., Limit data retention periods to minimize breach impact., Conduct regular HIPAA security risk assessments with third-party auditors., Segment networks to isolate sensitive data (e.g., enrollment systems)., Train employees on phishing awareness and incident reporting.Implement strict MFA for all email accounts, especially shared inboxes., Enforce password complexity and rotation policies with audits., Limit data retention periods to minimize breach impact., Conduct regular HIPAA security risk assessments with third-party auditors., Segment networks to isolate sensitive data (e.g., enrollment systems)., Train employees on phishing awareness and incident reporting.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are Shared inboxes with weak passwords are high-risk targets for phishing.,Prolonged data retention increases exposure in breaches.,MFA and password policies must be enforced rigorously in healthcare.,Regulatory non-compliance (e.g., HIPAA) amplifies financial and reputational damage.
References
Where can I find more information about each incident ?
Incident : Data Breach EYE4802448100725
Source: Information Security Media Group (ISMG)
Incident : Data Breach EYE4802448100725
Source: NY DFS Consent Order (2022-10)
Incident : Data Breach EYE4802448100725
Source: NY AG Settlement (2022-01)
Incident : Data Breach EYE4802448100725
Source: 4-State AG Settlement (NJ, FL, PA, OR; 2023-05)
Incident : Data Breach EYE4802448100725
Source: HHS Breach Report (2020-09)
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Information Security Media Group (ISMG), and Source: NY DFS Consent Order (2022-10), and Source: NY AG Settlement (2022-01), and Source: 4-State AG Settlement (NJ, FL, PA, OR; 2023-05), and Source: HHS Breach Report (2020-09).
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach EYE4802448100725
Investigation Status: Closed (settlements finalized; final court hearing on 2026-01-07)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Class-Action Settlement Notifications, Regulatory Disclosures (Hhs and State Ags).
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Data Breach EYE4802448100725
Stakeholder Advisories: Class-Action Settlement Notices, Regulatory Filings (Hhs, State Ags).
Customer Advisories: Breach notifications (2020)Settlement claims process (up to $10,100 per affected individual)
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Class-Action Settlement Notices, Regulatory Filings (Hhs, State Ags), Breach Notifications (2020), Settlement Claims Process (Up To $10,100 Per Affected Individual) and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Data Breach EYE4802448100725
Entry Point: Phishing email (compromised shared inbox)
High Value Targets: Customer Enrollment Data, Pii,
Data Sold on Dark Web: Customer Enrollment Data, Pii,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach EYE4802448100725
Root Causes: Weak Password On Shared Email Inbox, Lack Of Mfa, Excessive Data Retention (6+ Years), Inadequate Hipaa Compliance (Risk Assessments),
Corrective Actions: Enhanced Mfa And Password Policies, Third-Party Hipaa Security Risk Assessment, Reduced Email Retention Periods, Mandatory Security Awareness Training, Audit Mechanisms For Weak Passwords,
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Enhanced Mfa And Password Policies, Third-Party Hipaa Security Risk Assessment, Reduced Email Retention Periods, Mandatory Security Awareness Training, Audit Mechanisms For Weak Passwords, .
Additional Questions
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2020-09.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2020-09.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was $12.6M+ (regulatory fines, settlements, and litigation costs).
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Personal Data, Sensitive Customer Information and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was Shared Employee Email Inbox (enrollment processing).
Response to the Incidents
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Shortened email retention periodEnhanced MFAPassword policy updates.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Personal Data and Sensitive Customer Information.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 2.1M.
Regulatory Compliance
What was the highest fine imposed for a regulatory violation ?
Highest Fine Imposed: The highest fine imposed for a regulatory violation was $12.6M+ ($4.5M NY DFS, $600K NY AG, $2.5M 4-state AG, $5M class-action).
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Class-action lawsuit (settled 2026-01-07), NY DFS Consent Order (2022-10), NY AG Settlement (2022-01), 4-State AG Settlement (2023-05), .
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Regulatory non-compliance (e.g., HIPAA) amplifies financial and reputational damage.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enforce password complexity and rotation policies with audits., Implement strict MFA for all email accounts, especially shared inboxes., Limit data retention periods to minimize breach impact., Train employees on phishing awareness and incident reporting., Segment networks to isolate sensitive data (e.g., enrollment systems). and Conduct regular HIPAA security risk assessments with third-party auditors..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are NY DFS Consent Order (2022-10), 4-State AG Settlement (NJ, FL, PA, OR; 2023-05), NY AG Settlement (2022-01), HHS Breach Report (2020-09) and Information Security Media Group (ISMG).
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Closed (settlements finalized; final court hearing on 2026-01-07).
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Class-action settlement notices, Regulatory filings (HHS, state AGs), .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Breach notifications (2020)Settlement claims process (up to $10 and100 per affected individual).
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker was an Phishing email (compromised shared inbox).
.png)
Latest Global CVEs (Not Company-Specific)
Description
Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error view template `login.twig` of versions 2.19.1 and below. The `username` value can be echoed back without proper contextual encoding when authentication fails. An attacker can execute script in the login page context. This issue has been fixed in version 2.19.2.
Risk Information
cvss3
Base: 5.4
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Description
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because the application improperly handles user-supplied data in the createResultElement method by using the unsafe innerHTML property to render domain search results.
Description
A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly validate uploaded file contents. Additionally, the application preserves the user-supplied file extension during the save process. This allows an unauthenticated attacker to upload arbitrary PHP code by spoofing the MIME type as an image, leading to full system compromise.
Description
A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above.
Risk Information
cvss3
Base: 6.0
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
cvss4
Base: 6.0
Severity: LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
Description
An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint returns a list of cashier accounts, including names, email addresses, usernames, and passwords hashed using MD5. As MD5 is a broken cryptographic function, the hashes can be easily reversed using public tools, exposing user credentials in plaintext. This allows remote attackers to perform unauthorized logins and potentially gain access to sensitive POS operations or backend functions.
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=eyemed-vision-care' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
