In 2020, EyeMed Vision Care suffered a phishing email breach where hackers accessed a shared inbox used by nine employees for enrollment processing. The compromised email, protected only by a weak password, contained six years of sensitive customer data, including personal and potentially financial information. The breach impacted up to 2.1 million individuals nationwide, though the class action settlement covered ~692,154 members. Regulatory fines and settlements have cost EyeMed over $12.6 million, including a $5M class action payout, $4.5M to New York’s DFS, $600K to the NY AG, and $2.5M to four other states. The company also faced mandatory security upgrades, including MFA enhancements, password audits, HIPAA risk assessments, and reduced email retention periods. The breach exposed customers to potential fraud, identity theft, and financial losses, with class members eligible for compensation up to $10,000 for documented damages. EyeMed denied wrongdoing but agreed to settlements to resolve negligence and compliance violation claims.