2025 Laurel Eye Clinic — unauthorized access; 42k+ patients notified Apr 2026
Data compromised
Names, DOB, driver's licenses, account credentials, medical information, health insurance information
Technical writeup
Laurel Eye Clinic and affiliated Pennsylvania practices disclosed a security incident first identified January 25, 2025. A third-party forensic investigation reportedly confirmed unauthorized file theft by March 6, 2025; review workflows extended into late 2025. After obtaining verified contact lists, notices for 42,295 individuals were mailed from April 15, 2026, per HIPAA trade reporting. Data categories described publicly included demographics, driver's licenses, account credentials, medical information, and health insurance records.
Root cause
Unauthorized external access to organizational systems