Vision Care Providers Settle Data Breach Class Actions After Patient Data Exposures Two vision care providers Total Vision in California and Naper Grove Vision Care in Illinois have reached settlements in class action lawsuits following cyberattacks that compromised sensitive patient data. ### Total Vision Settlement Total Vision LLC, which operates optometry centers across California, suffered a hacking incident on or around October 30, 2020, when attackers accessed a database containing patient information, including names, addresses, dates of birth, Social Security numbers, and prescription details. The breach affected 138,402 current and former patients and was reported to the HHS’ Office for Civil Rights. Two class action lawsuits were consolidated into Ramey, et al. v. Total Vision, LLC, et al. in the Superior Court of California, County of San Diego, alleging negligence, breach of implied contract, and violations of California’s unfair competition law, Confidentiality of Medical Information Act, and security notification laws. Plaintiffs claimed the breach led to attempted identity theft and data misuse, though the defendants denied wrongdoing. The settlement, finalized after mediation on November 21, 2023, includes: - A $475,000 settlement fund, covering attorneys’ fees, administrative costs, and class member benefits. - Reimbursement of up to $1,000 per class member for documented losses. - Pro rata cash payments for those not claiming losses, depending on valid claims. - $224,000 in improved data security measures by the defendants. - Deadlines: Exclusion/objection by September 4, 2026, claims by October 5, 2026, and a final fairness hearing on December 18, 2026. ### Naper Grove Vision Care Settlement Naper Grove Vision Care in Naperville, Illinois, experienced a May 2025 ransomware attack by the Interlock group, which accessed protected health information of 20,093 individuals, including names, addresses, birth dates, driver’s license numbers, insurance details, medical records, and some Social Security numbers. The breach was detected on May 24, 2025. Multiple lawsuits were consolidated into In re Naper Grove Data Breach Litigation in the Circuit Court of the Eighteenth Judicial Circuit, DuPage County, Illinois, alleging negligence, breach of implied contract, and violations of the Illinois Consumer Fraud and Deceptive Business Practices Act. The defendant denied all claims. The settlement includes: - A $50,000 settlement fund for pro rata cash payments or reimbursement of up to $1,000 per class member for documented losses. - A one-year credit and medical data monitoring service for all class members. - Deadlines: Exclusion/objection and claims by September 18, 2026, with a final approval hearing on October 20, 2026. Both settlements were reached without admission of fault or liability.