2 Eye Care Practice Hacks Affect 260,000 Patients, Staff

Two separate hacks on ophthalmology practices in South Dakota and Florida have affected more than a quarter-million patients. The cyberattacks were among the latest of several major data breaches reported in recent months by eye care providers.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

The incidents were reported by Black Hills Regional Eye Institute, which is based in Rapid City, South Dakota, and Retina Group of Florida, based in Fort Lauderdale, Florida.

BHREI, which operates an ambulatory eye surgery facility in South Dakota and several satellite offices in South Dakota and neighboring Wyoming, said its hacking incident, which involved data theft, affected nearly 107,000 people.

BHREI first reported the breach to federal regulators in March with a placeholder estimate for the number of people affected. BHREI in a breach notice issued on Aug. 29 said it recently begun notifying affected patients.

BHREI said that on about Jan. 8, it observed suspicious activity within its network environment and immediately took steps to mitigate the threat, including taking some IT systems offline.

A forensics investigation determined on Feb. 7 that access and acquisition to BHREI’s data started as early as Jan. 4. BHREI’s investigation and data analysis found that potentially compromised information included names, Social Security number, date of birth, date of service, diagnostic and treatment information, driver’s license number, insurance information, medical record number, medical history, treatment location, medications, provider name, surgical information and credit card information.

Both patients and employees were potentially affected by the incident. “BHREI has no evidence that any personal information has been or will be misused for identity theft as a direct result of this incident,” the practice said.

Retina Group of Florida Breach

Retina Group of Florida is a practice that operates nearly two dozen offices in the Sunshine State and specialize in the diagnosis and treatment of disorders of the retina, macula, vitreous and related structures of the eye. Retina Group told the U.S. Department of Health and Human Services on Sept. 3 that its hacking breach affected nearly 153,000 patients.

Retina Group of Florida has not yet posted a public breach notice on its website and did not immediately respond to Information Security Media Group’s request for details about its hack.

As of Tuesday, several law firms had issued public notices saying they are investigating the Retina Group of Florida and BHREI breaches for potential class action litigation.

The BHREI and Retina Group of Florida hacking incidents are among nearly a dozen major health data breaches posted so far in 2025 on the HHS’ Office for Civil Rights’ HIPAA Breach Reporting Tool website listing breaches affecting 500 or more individuals.

So far those reported incidents involving eye care specialty practices in 2025 have affected a total of nearly 500,000 people.

The largest such incident was reported in January by Asheville Eye Associates, which operates 10 eye care centers in Western North Carolina (see: Georgia Nursing Home Notifying 120,000 of Hack).

Asheville Eye Associates initially told HHS OCR on Jan. 17 that its 2024 hacking incident affected about 193,000 patients. But in recent weeks, the facility filed an updated report to HHS OCR, saying its hack affected nearly 205,000 people.

Asheville Eye Associates in a breach notice posted on its website on Jan. 31 said an investigation into the incident determined that information was accessed and acquired, including potentially name, address, health insurance information and medical treatment information.

Security experts contend that small healthcare practices, including medical specialty practices such as eye doctors – as well as radiologists, orthopedists, oncologists and similarly focused providers – often operate under severely constrained IT budgets and limited cybersecurity expertise.

“Smaller practices often lack the resources needed to implement adequate cybersecurity measures, leaving them exposed to opportunistic attacks,” said Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center (see: Hacks on Specialty Health Entities Affect Nearly 900,000).