Cyber Incident Victim: Total Vision
Timeline
Summary
Total Vision experienced a data breach that exposed patient information such as birth dates, Social Security numbers, and medical details, leading to a class action lawsuit alleging inadequate cybersecurity protections. The organization agreed to a $475,000 settlement, providing cash payments to affected individuals, up to $1,000 for out‑of‑pocket losses, and committing to security improvements valued at $224,000 without admitting wrongdoing.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 0 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 30, 2020, Total Vision, an eye care network with locations in California that provides services such as eye exams, contact lens fittings, and vision therapy, experienced a data breach in which unauthorized actors gained access to its systems. The intrusion exposed sensitive patient information, including birth dates, Social Security numbers, medical details and other personal data. According to the class action lawsuit that followed, the breach resulted from alleged failures by Total Vision to implement reasonable cybersecurity safeguards that could have prevented the intrusion. Affected individuals later received a data breach notification letter from Total Vision informing them that their personal information had been compromised. The settlement notice explains that the class consists of those who received this notification regarding the October 30, 2020 incident.
The exposure of personal identifiers placed affected individuals at risk of identity theft, fraudulent financial activity, and misuse of their medical information. Plaintiffs in the lawsuit asserted that the lack of adequate security measures led to tangible harms, including out‑of‑pocket expenses incurred to mitigate potential fraud, such as fees for credit monitoring, fraudulent charges, credit expenses and other related costs. The lawsuit contended that Total Vision’s alleged negligence directly caused these financial burdens on the class members. In response to the claims, the parties negotiated a settlement that would provide monetary relief to those impacted without requiring an admission of wrongdoing from Total Vision.
On August 19, 2026, Total Vision agreed to a class action settlement totaling $475,000 to resolve the allegations. Under the settlement terms, class members who submit a valid claim form by October 5, 2026, are eligible to receive a cash payment, with those who can document out‑of‑pocket expenses related to the breach able to recover up to $1,000 for such losses. Additionally, the settlement includes business practice commitments valued at $224,000, intended to improve Total Vision’s data security measures. Important procedural dates include the deadline for exclusion or objection on September 4, 2026, the final approval hearing scheduled for December 18, 2026, and the requirement that claim forms be filed no later than October 5, 2026 to receive any settlement benefits.