EyeMed Data Breach Class Action Lawsuit, Were Your Social Security Number and Insurance Information Exposed After a File Was Emailed to the Wrong Person?

EyeMed Vision Care LLC is facing a proposed class action lawsuit after a September 2026 privacy incident involving members’ personal information, including Social Security numbers, dates of birth, addresses and vision-plan member identification numbers.

Christie Buonsante filed Buonsante v. EyeMed Vision Care LLC, Case No. 1:26-cv-01096, on October 26, 2026, in the U.S. District Court for the Southern District of Ohio. That was three days after EyeMed reported the incident to the Vermont Attorney General.

Key distinction: EyeMed says this was not a hacking incident. Its notice says a file containing member information was sent to an incorrect email address on September 22, 2026, that the company found the mistake the same day, that it was human error, and that its systems, network and applications were not compromised. The lawsuit alleges that EyeMed failed to use reasonable safeguards and failed to notify people promptly. These are allegations, not findings.

As of November 4, 2026, there is no settlement, no certified class, no claim form and no guaranteed payment in this case.

Quick Facts: EyeMed Data Breach Lawsuit

Detail	Information
Case	Buonsante v. EyeMed Vision Care LLC
Case number	1:26-cv-01096
Court	U.S. District Court, Southern District of Ohio
Plaintiff	Christie Buonsante
Defendant	EyeMed Vision Care LLC (Mason, Ohio)
Filed	October 26, 2026
Incident date	September 22, 2026
First state regulator disclosure reported	October 23, 2026 (Vermont Attorney General)
Incident type	Member file sent to an incorrect email address
EyeMed’s stated cause	Human error; no compromise of systems, network or applications
People affected	Approximately 19,400 to 19,600, per public breach-record tracking
Data potentially involved	Names, addresses, dates of birth, Social Security numbers, member ID numbers (varies by person)
Claims alleged	Negligence, negligence per se, breach of implied contract, unjust enrichment
Plaintiff’s counsel	Terence R. Coates, Dylan J. Gould, Spencer D. Campbell (Markovits, Stock & DeMarco LLC); Mariya Weekes (Milberg PLLC)
Settlement	None
Class certification	Not granted
Claim deadline	None announced

1. What Happened in the EyeMed Incident?

EyeMed is a vision benefits administrator that manages vision plans for employers, individuals and families, covering exams, glasses and contact lenses through a provider network.

According to EyeMed’s individual notice template (published by the California Attorney General) and state filings:

1. On September 22, 2026, a file containing member information was sent to an incorrect email address.
2. EyeMed says it identified the error the same day.
3. EyeMed says it was human error, not a malicious act, and that the incident was limited to a single email without compromising its systems, network or applications.

There is no confirmed finding that hackers broke into EyeMed’s network. The disclosure was an unauthorized disclosure through a misdirected email.

Why can a wrong-address email still be a legal problem?

An insurance benefits administrator holds sensitive data. If a file reaches someone outside the intended group, that person may receive information they were never authorized to have. A name, date of birth and Social Security number together can be useful for identity verification and fraudulent applications, so even an accidental disclosure can raise real identity-theft risk. The legal questions are whether EyeMed had reasonable controls to prevent the disclosure, whether the recipient actually viewed or kept the file, and whether EyeMed gave legally adequate notice.

2. Timeline

Date	Event
September 22, 2026	File sent to incorrect email address; EyeMed says it identified the error the same day
October 23, 2026	EyeMed reported the incident to the Vermont Attorney General
October 26, 2026	Buonsante filed her proposed class action; related Berryan case filed the same day
October 27, 2026	Dean v. EyeMed filed
October 28, 2026	Tanilli et al. v. EyeMed filed; more state disclosure activity appeared
October 29, 2026	Order reassigning the Buonsante case
October 30, 2026	EyeMed’s individual notice template appeared in California Attorney General records
November 2 to 3, 2026	Additional state breach-notification records appeared

The gap between discovery (September 22) and the first public regulator filings (October) is a central point in the notification allegations. But the public sample notice does not show the exact date each person received an individual letter, so the gap alone does not prove a violation of any notification deadline.

3. How Many People Were Affected?

Public breach-notification trackers put the total at roughly 19,400 to 19,600. Records tied to the Texas Attorney General initially listed about 19,602 people (1,740 Texas residents), and a later summary listed 19,425 people (1,733 Texas residents). Other state records reported 14 Vermont residents and 192 Massachusetts residents. The California sample notice does not give a separate California count.

Treat these as reported estimates, not a verified final count.

4. What Personal Information Was Involved?

Information	Why it matters
Full name	Identifies the person
Home address	Used in identity verification
Date of birth	Sensitive identifier
Social Security number	Highest identity-theft risk
Member identification number	Identifies vision coverage

EyeMed’s notice says the elements vary by person, so not everyone had every category involved. Some coverage mentions health insurance or medical information, but the published California notice template does not list eye prescriptions, diagnoses, treatment notes or exam records. The 2020 EyeMed cyberattack involved broader data, including medical histories, but that was a separate incident. Your own notice letter controls what applies to you.

5. What EyeMed Says It Is Doing

Per the notice template, EyeMed says it will revise privacy and operational policies, update employee training and retrain staff, and provide complimentary identity monitoring through Kroll. It lists a dedicated call center at (844) 971-8613, Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern, excluding major U.S. holidays. Confirm the number and enrollment details against your own letter.

The Kroll services described are:

• Single-bureau credit monitoring: alerts to changes such as new credit applications.
• Fraud consultation: access to a specialist about suspicious activity and protection options.
• Identity theft restoration: a licensed investigator helps resolve identity-theft problems.

The template leaves the service length and enrollment deadline as placeholders, so check your personal letter. Enrollment is directed to enroll.krollmonitoring.com. Always verify instructions against a genuine EyeMed notice, because scammers imitate breach notices.

6. Who Is Christie Buonsante and What Does She Allege?

Buonsante says she is an EyeMed member who was required to provide her name and Social Security number to obtain services. She alleges that EyeMed failed to adequately protect that information and did not give prompt, full notice. She also alleges that after the incident she saw more spam calls, texts and emails, and spent hours reviewing accounts, checking credit reports and changing passwords, and she describes anxiety and stress.

An increase in spam does not by itself show that the misdirected file was opened, copied or used. No confirmed finding has linked this incident to identity theft or financial fraud. That gap will matter when the court examines causation and damages.

7. What Does the Lawsuit Claim?

Negligence. The complaint alleges EyeMed owed a duty of reasonable care in handling members’ data and breached it. Negligence generally requires duty, breach, causation and legally recognized damages. The main fights will be reasonable care and compensable harm.

Negligence per se. Under this doctrine, violating a statute or regulation designed to protect a class of people from a type of harm can establish breach. It does not establish causation or damages, and a statute that offers no private damages remedy does not automatically become one this way.

Breach of implied contract. The plaintiff argues members gave sensitive data to obtain benefits with an implied expectation that EyeMed would protect it. The court must decide whether an enforceable implied promise existed and was breached.

Unjust enrichment. The claim is that EyeMed received benefits from members while allegedly failing to provide the data protection they reasonably expected.

Relief requested: damages, injunctive relief (improved data practices), lifetime credit monitoring, identity theft insurance, a jury trial and other relief the court considers proper. These are requests, not rulings.

8. Laws That Apply or May Apply

A. HIPAA, HITECH and the Breach Notification Rule

The Health Insurance Portability and Accountability Act of 1996 sets federal standards for protected health information (PHI). The HITECH Act (2009) added breach notification duties and strengthened enforcement, including state attorney general authority under 42 U.S.C. § 1320d-5(d). EyeMed’s role (covered entity or business associate, depending on the plan arrangements) affects which duties apply.

The Breach Notification Rule, 45 CFR §§ 164.400 to 164.414, generally requires:

• Individual notice without unreasonable delay and no later than 60 days after discovery (45 CFR § 164.404).
• Media notice for breaches involving more than 500 residents of a state or jurisdiction (§ 164.406).
• HHS notice contemporaneously for breaches affecting 500 or more people, and within 60 days after the end of the calendar year for smaller breaches (§ 164.408).

Under 45 CFR § 164.402, an impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented risk assessment shows a low probability the PHI was compromised. The assessment weighs four factors: (1) the nature and extent of the PHI, including identifiers and re-identification risk; (2) who received it; (3) whether it was actually acquired or viewed; and (4) how far the risk has been mitigated. For a wrong-recipient email, the recipient’s identity, whether the file was opened, and any assurance of deletion are the key facts.

The Security Rule (45 CFR Part 164, Subpart C) separately requires administrative, physical and technical safeguards for electronic PHI, and the Privacy Rule requires workforce training and safeguards against impermissible disclosures (45 CFR § 164.530).

Important: HIPAA does not give individuals a private right to sue for a HIPAA violation. HHS and state attorneys general enforce it. HIPAA standards may still inform state-law claims such as negligence.

Reference: HHS Breach Notification Rule.

B. Ohio Revised Code § 1349.19 (Ohio breach notification)

Ohio generally requires notice to Ohio residents when computerized personal information is accessed and acquired by an unauthorized person and creates a material risk of identity theft or fraud. Notice must generally be given in the most expedient time possible and no later than 45 days after discovery, subject to exceptions. Personal information is defined as a name plus certain elements such as a Social Security number. The statute has an exemption for HIPAA covered entities and is generally enforced by the Ohio Attorney General rather than through private suits. Whether it applies here depends on EyeMed’s regulatory status and the facts of the disclosure.

Reference: Ohio Revised Code § 1349.19.

C. Ohio Data Protection Act (R.C. Chapter 1354)

Section 1354.02 provides an affirmative defense to certain tort claims alleging inadequate security for businesses that maintain and comply with a written cybersecurity program that reasonably conforms to a recognized framework such as the NIST Cybersecurity Framework, ISO/IEC 27000 standards or applicable HIPAA security requirements. Having policies is not enough; the program must meet the statute’s requirements. This could be a defense to the negligence-based claims.

Reference: Ohio Revised Code Chapter 1354.

D. Other state laws that could matter

Because affected people live in many states, other laws may come into play:

• Texas (Bus. & Com. Code § 521.053): individual notice generally within 60 days of determining a breach, and notice to the Texas Attorney General within 30 days when 250 or more Texas residents are affected. Texas residents in this incident were reported at roughly 1,733 to 1,740.
• Vermont (9 V.S.A. § 2435): preliminary notice to the Attorney General within 14 business days of discovery and consumer notice within 45 days, subject to exceptions. Exactly when “discovery” occurred will matter.
• Massachusetts (G.L. c. 93H): notice to affected residents, the Attorney General and the Office of Consumer Affairs and Business Regulation.
• California (Civ. Code § 1798.82 and the Confidentiality of Medical Information Act, Civ. Code § 56 et seq.): the CMIA provides a private right of action with nominal damages for certain unauthorized disclosures of medical information. The CCPA data breach provision (Civ. Code § 1798.150) is generally limited for medical information and PHI already governed by HIPAA or CMIA.
• State consumer protection statutes, including the Ohio Consumer Sales Practices Act (R.C. Chapter 1345), which plaintiffs sometimes plead alongside negligence.

Which state’s law applies to each person is one of the biggest obstacles to a nationwide class.

E. Article III standing in data-exposure lawsuits

Federal courts require a concrete injury. Key cases:

• Spokeo, Inc. v. Robins, 578 U.S. 330 (2016): an injury must be concrete and particularized, not just a bare statutory violation.
• Clapper v. Amnesty International USA, 568 U.S. 398 (2013): future harm must be certainly impending.
• TransUnion LLC v. Ramirez, 594 U.S. 413 (2021): in a damages suit, each class member needs standing, and a risk of future harm alone generally does not suffice without a present concrete harm (or an actual materialization of that risk).
• Galaria v. Nationwide Mutual Insurance Co., 663 F. App’x 384 (6th Cir. 2016): the Sixth Circuit, whose law governs Ohio federal courts, found standing for data-theft victims based on increased risk and mitigation costs, but the facts there involved deliberate theft.

Here, because EyeMed says the information went to a wrong recipient and not to a hacker, whether the plaintiff can show a concrete injury caused by this disclosure is likely a major defense argument.

F. Federal Rule of Civil Procedure 23 and the Class Action Fairness Act

To certify a class, the court looks at numerosity, commonality, typicality and adequacy under Rule 23(a), plus predominance and superiority for damages classes under Rule 23(b)(3). Federal jurisdiction over a proposed nationwide class commonly rests on the Class Action Fairness Act (28 U.S.C. § 1332(d)), which requires at least 100 class members, more than $5 million in aggregate controversy and minimal diversity. A judge must also decide whether differing state laws let a nationwide group proceed together. The case is also not yet certified.

Reference: Federal Rule of Civil Procedure 23.

G. Federal consumer protection laws that help affected people

• Free credit freezes and fraud alerts: the Fair Credit Reporting Act as amended by the 2018 Economic Growth, Regulatory Relief, and Consumer Protection Act (15 U.S.C. § 1681c-1) makes security freezes free at all three major credit bureaus and provides for fraud alerts.
• Credit report disputes: 15 U.S.C. § 1681i gives you the right to dispute inaccurate information.
• FTC Act § 5 (15 U.S.C. § 45) bars unfair or deceptive practices, including unreasonable data security, but is enforced by the FTC and has no private right of action.
• Identity theft crime: 18 U.S.C. § 1028 and 1028A criminalize identity theft; victims can report at IdentityTheft.gov.

9. Who Could Be in the Proposed Class?

The complaint proposes a nationwide class of people whose private information was accessed or acquired by an unauthorized party in the incident. That is a proposed definition, not a court-approved one. Potentially relevant facts are: you were enrolled in an EyeMed-managed vision plan, you received an EyeMed notice about the September 2026 incident, your information was in the file, and you experienced a legally recognized harm.

You do not necessarily have to live in Ohio, but the court has not certified a nationwide class. You also do not necessarily need to prove identity theft to ask about your legal rights, but a damages claim generally requires a legally recognized injury and a link to the incident. Spam alone does not prove causation.

10. How This Differs From the Earlier $5 Million EyeMed Settlement

EyeMed previously faced Tate, et al. v. EyeMed Vision Care LLC, Case No. 1:21-cv-36, in the same Ohio federal court, over a June 2020 incident in which an unauthorized person accessed an EyeMed email account. That account held names, addresses, dates of birth, contact details, vision account numbers, Medicaid and Medicare numbers, Social Security numbers and medical histories, and affected roughly 2.1 million people. The case produced a $5 million class settlement that received final approval on September 18, 2026.

Issue	2020 incident	2026 incident
Date	June 2020	September 22, 2026
What happened	Unauthorized access to an email account	File sent to wrong email recipient
Systems compromised	Yes (email account)	EyeMed says no
Cause described	Cyberattack by unknown actors	Human error
Lawsuit	Tate v. EyeMed	Buonsante v. EyeMed
Case number	1:21-cv-36	1:26-cv-01096
Settlement	$5 million, finally approved Sept. 18, 2026	None

The $5 million settlement covers the 2020 incident only. People affected in 2026 do not automatically qualify for that fund. Headlines mentioning it can wrongly suggest a new settlement.

11. Other EyeMed Lawsuits

Several separate federal suits were filed in the Southern District of Ohio around the same time.

Case	Case number	Filed
Buonsante v. EyeMed	1:26-cv-01096	October 26, 2026
Berryan v. EyeMed	1:26-cv-01097	October 26, 2026
Dean v. EyeMed	1:26-cv-01101	October 27, 2026
Tanilli et al. v. EyeMed	1:26-cv-01108	October 28, 2026

These are separate cases and are not automatically consolidated. Plaintiffs or the court may later seek coordination or consolidation (see Fed. R. Civ. P. 42(a)), but no such order should be assumed. As of November 4, 2026, no class certification order or settlement approval has been identified in Buonsante.

12. What Affected Members Should Do

1. Read your notice. Check which of your information was involved; it varies by person.
2. Enroll in the free Kroll services if offered, and note the enrollment deadline and duration in your letter.
3. Check your credit reports for free at AnnualCreditReport.com.
4. Consider a credit freeze at Equifax, Experian and TransUnion. It is free by law. It helps block new accounts but does not stop every form of fraud. You can also place a fraud alert.
5. Review insurance and benefit statements for claims or services you do not recognize, and contact your insurer if you see any.
6. Watch for tax identity theft. Consider an IRS Identity Protection PIN (IP PIN) and file your return early.
7. Report suspected identity theft at IdentityTheft.gov and to local police.
8. Be alert to scams. Do not click links or give information in unexpected calls, texts or emails claiming to be EyeMed or Kroll.
9. Preserve evidence: the notice, enrollment confirmation, correspondence, and proof of any losses or time spent.

13. Can You Get Money From the Lawsuit?

No settlement payment is available in Buonsante as of November 4, 2026. The complaint requests damages, but the court has not decided liability. Keep three things separate:

• Free identity monitoring: an existing EyeMed offer through Kroll.
• Possible lawsuit compensation: only if the case succeeds or reaches an approved settlement.
• The earlier $5 million settlement: concerns the 2020 incident and its own defined class.

There is no claim form or deadline for the 2026 lawsuit. Do not pay any website that promises to register you for a guaranteed EyeMed payment. If a settlement is later reached, any legitimate claims process will be court-approved and typically does not charge claimants a fee.

14. What Happens Next?

The case is early. Likely developments include EyeMed’s response or motion to dismiss (including on standing and failure to state a claim), possible coordination of the related suits, discovery on EyeMed’s email controls and training, evidence about whether the recipient opened or kept the file, and, if the case survives, a class certification fight. EyeMed’s position that it caught the error immediately and that no systems were compromised will likely be central to its defense. The plaintiffs will likely argue the company’s safeguards and training were inadequate. The court must decide on evidence, and there is no final decision on liability or class certification.

Frequently Asked Questions

Is there an EyeMed data breach class action lawsuit?

Yes. Christie Buonsante filed a proposed class action on October 26, 2026, in the Southern District of Ohio, Case No. 1:26-cv-01096. Other related suits were filed around the same time.

Was EyeMed hacked in September 2026?

EyeMed says no. Its notice says a member file was sent to an incorrect email address by human error and that its systems, network and applications were not compromised.

What information was involved?

EyeMed’s notice lists names, addresses, dates of birth, Social Security numbers and member ID numbers, varying by person. Check your own letter.

How many people were affected?

Public breach trackers show roughly 19,400 to 19,600 people. Totals differ slightly across filings.

Does EyeMed offer free credit monitoring?

Yes. The notice template describes Kroll single-bureau credit monitoring, fraud consultation and identity theft restoration. Duration and deadlines are in your individual letter.

Is there a new $5 million EyeMed settlement?

No. The $5 million settlement is from Tate v. EyeMed over the June 2020 incident. No settlement exists for the 2026 incident.

Can I join the lawsuit or file a claim?

No claim form exists. The class has not been certified. If you want to discuss your rights, consider speaking with a licensed attorney. Do not pay anyone for a “guaranteed” payment.

Do I need to have suffered identity theft to have a claim?

Not necessarily to ask about your rights, but a damages claim generally requires a legally recognized injury connected to the incident.

Can people outside Ohio take part?

The lawsuit proposes a nationwide class, but the court has not certified it. Scope and applicable state laws may change.

Can I sue EyeMed directly under HIPAA?

No. HIPAA has no private right of action. HHS and state attorneys general enforce it, though HIPAA standards may be referenced in state-law claims.

What is the case number?

1:26-cv-01096, U.S. District Court for the Southern District of Ohio.

Final Takeaway

The EyeMed lawsuit raises a real question: how responsible is a benefits administrator when a sensitive file goes to the wrong person? EyeMed describes a single misdirected email, found the same day, with no system compromise. The plaintiff alleges inadequate safeguards and delayed notice. The outcome will turn on reasonable care, whether the recipient accessed the data, whether a concrete injury can be shown, and whether a nationwide class can be certified. For affected members, the immediate steps are to read the notice, activate any free Kroll protection and monitor credit and insurance accounts.

There is no new EyeMed settlement, guaranteed payment or claim deadline as of November 4, 2026.

Case Information

• Case: Buonsante v. EyeMed Vision Care LLC
• Case number: 1:26-cv-01096
• Court: U.S. District Court, Southern District of Ohio
• Filed: October 26, 2026
• Plaintiff: Christie Buonsante
• Defendant: EyeMed Vision Care LLC

Related All About Lawyer Coverage

• Veradigm Data Breach 2026 Lawsuits, Exposed Data, Next Steps
• CareCloud Data Breach Lawsuit, Were 3.75M Patients Affected?
• Eyemart Express Data Breach Lawsuit 2026, Are You Affected?

Sources and Legal References

1. California Attorney General: EyeMed Individual Notice Template
2. Top Class Actions: EyeMed Hit With Class Action Lawsuit Days After Data Breach Disclosure (Nov. 3, 2026)
3. Buonsante v. EyeMed docket information
4. HHS: HIPAA Breach Notification Rule
5. Ohio Revised Code § 1349.19
6. Ohio Revised Code Chapter 1354
7. Federal Rule of Civil Procedure 23
8. Tate v. EyeMed: September 18, 2026 Final Approval Order
9. Official EyeMed 2020 Data Breach Settlement Website

Disclaimer: All About Lawyer is an independent legal information website, not a law firm. This article is for general informational and educational purposes only and is not legal advice. The allegations against EyeMed have not been proven, and no class has been certified. Reading this article does not create an attorney-client relationship. If you believe you were harmed, consult a licensed attorney in your state.