Retina Group of Florida, an ophthalmology practice with 22 locations, suffered a major data breach affecting 152,691 patients. The incident, classified as a hacking attack, exposed highly sensitive personally identifiable information (PII) and protected health information (PHI), including names, addresses, dates of birth, Social Security numbers, driver’s license copies, health insurance details, medical records, and payment data. The breach significantly elevates risks of identity theft, financial fraud, and misuse of health data, as the exposed information can be exploited for malicious purposes. The company disclosed the incident to the U.S. Department of Health and Human Services (HHS) on September 3, 2025, and is notifying affected patients via mail. The severity stems from the large-scale compromise of critical patient data, which could lead to long-term reputational damage, legal repercussions, and financial losses for both the organization and its patients.

Retina Group of Florida, a private eye care practice specializing in retinal and macular disorders with over 20 locations across Florida, experienced a data breach discovered on November 9, 2024. Unauthorized access to its computer network occurred between November 6 and November 9, 2024, potentially exposing personal information, including names and other identifiers, of up to 153,429 individuals. The breach triggered an investigation and a potential class-action lawsuit by Edelson Lechtzin LLP, alleging compromised sensitive personal data of patients. While the exact nature of the accessed data (e.g., medical records, financial details) is unspecified, the scale and involvement of a healthcare provider suggest significant risks of identity theft, fraud, or misuse of protected health information (PHI). The incident underscores vulnerabilities in healthcare cybersecurity, where patient trust and regulatory compliance (e.g., HIPAA) are critical. Affected individuals are advised to monitor financial accounts and credit reports for suspicious activity.