EyeMed Vision Care, LLC filed updated state notices that put 19,425 people in a 22 September 2026 incident. The catalog entry now uses that Texas total, replacing an earlier row that only had 1,740 Texans and no overall census. The California Attorney General sample letter says EyeMed sent a file of member information to an incorrect email address. That is human error, not a described network intrusion. Fields can include name, address, date of birth, Social Security number, health-insurance information and member ID. The company offered Kroll identity monitoring in that letter. A class-action complaint followed in Ohio federal court days after the Vermont listing.
EyeMed is a vision-benefits company in the EssilorLuxottica group. It is not a newcomer to breach mail. A 2020 incident led to a roughly $5 million class settlement and a $2.5 million multi-state resolution covering about 2.1 million people, according to Oregon DOJ materials from that era. The 2026 file is a different event with a much smaller census. Do not add 2.1 million to 19,425.
What happened in the EyeMed data breach?
On 22 September 2026 someone at EyeMed sent a member file to the wrong inbox. The California notice frames it as human error. Discovery is dated the same day in that packet. Letters and AG filings landed from 23 October (Vermont, 14 residents) through 3 November (Texas, 1,733 residents and 19,425 total). An earlier Texas row on 28 October had listed 1,740 Texans. Use the later total.
A misdirected email is still a data breach under US notice laws when the file holds SSNs. It is not ransomware. It is not a dark-web dump unless someone in the wrong inbox forwards it. EyeMed has not said who received the file or whether that recipient deleted it. Until it does, assume the attachment could be copied.
Compare the scale with Amplifon's 1.33 million-person network filing the same week. Both are healthcare-adjacent. Only one is a wrong-To: line. Compare also the Harvard alumni-affairs notice, which is a large email-address census without this SSN mix.
What data was exposed?
Texas lists name, address, Social Security number, health-insurance information and date of birth. The California letter adds that elements vary by person and may include a member identification number. Vermont's listing is Social Security numbers for 14 people. Massachusetts later listed 192 residents with SSNs. Not every member had every field. If your letter omits SSN, do not copy a law-firm blog's full menu onto your case.
Vision-plan files can include exam dates and prescription data. The public AG rows do not list clinical notes as a separate object. They do list health-insurance information. Watch for fake "your glasses are ready" texts that already know your member ID.
Who is affected?
EyeMed benefits members in the 19,425. The Texas slice is 1,733 in the 3 November filing. If you received a letter, you are in the census. If you had EyeMed coverage in 2026 and received nothing, wait out the mail window. Employees of employer groups that use EyeMed may be in the file even if they never visited an optician this year.
What should I do after the EyeMed letter?
- Match the letter to the California sample on the Attorney General site. The sample lists (844) 971-8613. If your letter uses a different number, be suspicious.
- If an SSN is listed, freeze credit at Equifax, Experian and TransUnion and enrol in the Kroll product only via the letter, not via a search ad.
- Read vision-plan explanations of benefits for exams and frames you did not order.
- A class-action ad is not the notice. Do not paste your SSN into a "see if you qualify" form.
- Keep the letter. EyeMed's 2020 incident is closed history. This letter is the 2026 event.
The Vanguard Vermont notice is the same reading order: official letter, then freeze, then ignore lookalike mail.
Frequently asked questions
Is this a hack of EyeMed systems?
The California sample notice says a file was sent to an incorrect email address. That is a misdirection, not a described network attack.
How many people are in the file?
19,425 in the 3 November Texas filing. Earlier public rows showed only state slices.
Is this the 2020 EyeMed breach?
No. The 2020 event was larger and already settled. This notice is dated 22 September 2026.
Should I freeze credit if my letter has no SSN?
The freeze still helps if you want it. It is essential if the letter lists an SSN.
Is the class action proof of extra damage?
A complaint is an allegation. It is not a second census and not a substitute for the AG letter.
Sourcing note: 19,425 and the Texas slice come from the 3 November Texas AG filing as relayed by aggregations of that filing. The misdirected-email cause and Kroll offer come from the California AG sample notice dated 22 September 2026.