EyeMed Agrees to Pay $5M to Settle Email Breach Litigation

Ohio-based eye care benefits provider EyeMed Vision Care has agreed to pay $5 million and implement security improvements to settle civil class action litigation involving a 2020 phishing email data breach. The incident has been the subject of several previous multimillion dollar settlements and enforcement actions by multiple state regulators.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

Under the settlement, EyeMed will pay class members compensation of up to $100 for lost time responding to the data incident; up to $10,000 for documented, unreimbursed out-of-pocket expenses resulting from the breach; and an estimated $50 prorated cash payment of the remaining funds, which may by adjusted based on how many other claims are submitted

The net settlement fund includes $1.6 million – or one-third – for attorneys, and also $2,500 service awards for each of the three classes representatives in the lawsuit.

The settlement also calls for EyeMed to make improvements to its business and security practices.

That includes enhanced authorization requirements for people with access to EyeMed’s network; updating internal password reset requirements; additional mandatory security awareness training to EyeMed’s employees; auditing mechanisms to identify weak passwords; enhanced multifactor authentication protocols; shortening the retention period for the email box at the center of breach; and engaging a third-party firm to conduct an updated HIPAA security risk assessment.

EyeMed denies any wrongdoing, including claims alleged in the lawsuit of negligence, implied breach of contract and violations of various California state laws.

Class Size

The proposed settlement agreement defines the settlement class as “all natural persons who reside in the U.S. and to whom EyeMed issued notice of the data incident that certain personal data was impacted in the incident.”

Court documents indicate that under the proposed agreement, the settlement class consists of “roughly 692,154 class members.”

But that class member figure is considerably lower than previous estimates involving the number of people affected by the data breach.

EyeMed in September 2020 told the U.S. Department of Health and Human Services the breach affected 1.47 million people, and New York state regulators in 2022 enforcement actions said the EyeMed incident affected 2.1 million consumers nationwide, including 98,632 New Yorkers.

Neither the attorneys representing the plaintiffs and EyeMed in the civil class action litigation immediately responded to Information Security Media Group’s requests for comments on the settlement, and for clarification around how the number of class members was determined for the settlement.

A final court hearing in the class action lawsuit settlement is set for Jan. 7, 2026.

Previous Settlements

In the 2020 phishing incident, hackers accessed an inbox shared by nine EyeMed employees that was used for enrollment processing. The email box was protected by “only a weak password” and contained sensitive customer information dating back six years prior to the attack, New York State’s Department of Financial Services said in an October 2022 consent order against EyeMed.

That enforcement action included a $4.5 million financial settlement and corrective action plan (see: NY State Smacks EyeMed Vision With Another Breach Fine).

Months earlier, in January 2022, EyeMed agreed to pay $600,000 and also implement a long list of data security improvements as part of a settlement with the New York attorney general’s office (see: NY Fines Vision Benefits Firms $600,000 for 2020 Breach).

In addition to the two separate actions taken by New York State regulators, EyeMed in May 2023 agreed to pay a $2.5 million fine to the attorneys general of four other states – New Jersey, Florida, Pennsylvania and Oregon – for the same data breach (see: 4 State AGs Punch EyeMed with $2.5M Fine for 2020 Breach).

As of Monday, settlements and regulatory penalties related to the EyeMed email data breach have cost the company more than $12.6 million.