Cyber Incident Victim: Oregon Eye Specialists
Date:
Jun 2021
Location:
United States of America
Summary
Oregon Eye Specialists experienced a data breach stemming from unauthorized access to employee email accounts over a two-month period, exposing patient names combined with sensitive details such as dates of birth, medical record numbers, financial account information, and health insurance policy data. The organization detected unusual account activity, secured compromised systems by resetting credentials and enhancing security protocols, and notified potentially impacted individuals while offering complimentary credit monitoring and identity protection services despite finding no evidence of actual data misuse.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Oregon Eye Specialists, a US optometry group operating six clinics in Portland, disclosed a data breach stemming from unauthorized access to internal email accounts. On August 10, 2021, the organization identified unusual activity in an employee email account, prompting immediate password resets and implementation of additional security measures. A subsequent investigation revealed that attackers had accessed certain email accounts over a two-month period, from June 29, 2021, to August 31, 2021. The compromised data included patients' names combined with one or more of the following elements: dates of birth, dates of service, medical record numbers, financial account information, and health insurance provider names or policy numbers. While the organization stated it found no evidence of actual or attempted misuse of the exposed information, it formally notified potentially impacted individuals through a data breach alert published on October 8, 2021. The breach exposed sensitive personal and medical details that could facilitate identity theft or financial fraud, though the exact number of affected individuals remained undisclosed in available reports.
In response to the incident, Oregon Eye Specialists offered affected individuals complimentary credit monitoring and identity protection services. The organization advised patients to monitor their credit reports, financial account statements, and explanation-of-benefits forms for unauthorized activity. This breach occurred amid a series of similar incidents affecting the US optometry sector in mid-2021, including breaches at USV Optical (impacting 180,000 individuals), Simon Eye (affecting over 144,000 patients), and Wolfe Eye Clinic (potentially exposing data of 500,000 patients). The pattern extended internationally with a ransomware attack against Singapore's Eye & Retina Surgeons compromising 73,000 patient records. Oregon Eye Specialists' containment actions focused on securing email systems rather than disclosing technical details about the attack methodology or whether external cybersecurity experts assisted in the investigation. The disclosure timeline showed a 59-day gap between detecting the breach and notifying potential victims, with no public confirmation of whether regulatory authorities were notified or whether the incident involved phishing, credential theft, or other specific attack vectors.