EyeMed Vision Care

A hacker sat inside an EyeMed employee's email account for roughly a week in June 2020 and reached personal and vision-plan health information for around 2.1 million people. A week is a long time in this context - long enough to read, search, forward and export at leisure - and the entry point was, again, one inbox rather than a hardened claims system. Vision plans occupy a strange blind spot in consumer risk assessment: people mentally file them alongside a gym membership rather than alongside health insurance, so the data they hold gets far less scrutiny than a medical plan's, despite the enrollment records containing the same identifiers a medical plan holds.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Data sharing

HISTORICAL CONFIRMED BREACH (2020): EyeMed disclosed a breach in which a hacker accessed an employee email account for about a week (June 2020), exposing personal and some vision-plan/health information for approximately 2.1 million members — a resulting class action was filed, and this remains a significant historical incident for this specific vision insurer, though this research pass could not confirm a more recent (2025-2026) follow-up incident.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.