Incident Types: The types of cybersecurity incidents that have occurred include Ransomware.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with cybersecurity experts, and and containment measures with secured environment, and remediation measures with stronger password requirements, remediation measures with more frequent password changes, remediation measures with reduced access permissions, remediation measures with offline storage of older data, and communication strategy with website notice (oct. 30, 2025), communication strategy with toll-free call center (800-405-6108, mon-fri 8 a.m.–8 p.m. et), communication strategy with advisories for monitoring financial accounts/credit reports, communication strategy with fraud alert/credit freeze recommendations, and enhanced monitoring with implemented (post-breach)..

Common Attack Types: The most common types of attacks the company has faced is Ransomware.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personal Information (Pii), Protected Health Information (Phi) and .

Third-Party Assistance: The company involves third-party assistance in incident response through Cybersecurity experts, .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Stronger password requirements, More frequent password changes, Reduced access permissions, Offline storage of older data, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by secured environment and .

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Beware of phishing (unsolicited emails/calls requesting personal info), Review notices from Tri-Century Eye Care, Place fraud alerts/credit freezes with credit bureaus and Monitor financial accounts and credit reports for identity theft.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Tri-Century Eye Care Website NoticeDate Accessed: 2025-10-30, and Source: PEAR Ransomware Group Dark Web Forum PostDate Accessed: 2025-09-18.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Website Notice (Oct. 30, 2025), Toll-Free Call Center (800-405-6108, Mon-Fri 8 A.M.–8 P.M. Et), Advisories For Monitoring Financial Accounts/Credit Reports and Fraud Alert/Credit Freeze Recommendations.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Toll-Free Call Center For Questions (800-405-6108), Guidance On Fraud Prevention And Credit Monitoring, Review Notices From Tri-Century Eye Care, Monitor For Identity Theft/Financial Fraud, Consider Credit Freezes/Fraud Alerts, Avoid Sharing Personal Info In Response To Unsolicited Contacts and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Cybersecurity Experts, , Implemented (post-breach).

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Enhanced Password Policies, Reduced Access Permissions, Offline Storage For Older Data, .

Last Attacking Group: The attacking group in the last incident was an PEAR ransomware group.

Most Recent Incident Detected: The most recent incident detected was on 2025-09-03.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-10-30.

Most Significant Data Compromised: The most significant data compromised in an incident were Names, Social Security numbers, Dates of birth, Medical/health information, Health care treatment/diagnostic information, Health insurance information, Billing/payment information, Tax/financial information and .

Most Significant System Affected: The most significant system affected in an incident was Internal network.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was cybersecurity experts, .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Secured environment.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Social Security numbers, Health care treatment/diagnostic information, Medical/health information, Tax/financial information, Dates of birth, Health insurance information, Names and Billing/payment information.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 0.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Beware of phishing (unsolicited emails/calls requesting personal info), Review notices from Tri-Century Eye Care, Place fraud alerts/credit freezes with credit bureaus and Monitor financial accounts and credit reports for identity theft.

Most Recent Source: The most recent source of information about an incident are PEAR Ransomware Group Dark Web Forum Post and Tri-Century Eye Care Website Notice.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Completed (as of public disclosure).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Toll-free call center for questions (800-405-6108), Guidance on fraud prevention and credit monitoring, .

Most Recent Customer Advisory: The most recent customer advisory issued was an Review notices from Tri-Century Eye CareMonitor for identity theft/financial fraudConsider credit freezes/fraud alertsAvoid sharing personal info in response to unsolicited contacts.