Tri-Century Eye Care 2025 Data Breach

The primary document is the organization's “Notice of Data Security Incident” dated October 30, 2025. The archived PDF describes the September 3 discovery, September 19 scope finding, an unknown actor acquiring files, data types, unaffected current EMR system, additional safeguards, HHS and FBI notifications, and the 1-800-405-6108 assistance line.

The second source is the official HHS/OCR entry dated October 31 for 200,000 people. A public breach source's incident page independently connects the same official notice and federal total.

When Tri-Century identified suspicious network activity September 3, it secured the environment and began an investigation with cybersecurity experts. By September 19, information indicated that an unknown actor had unauthorized network access and acquired certain files containing personal or protected health information belonging to employees and patients.

The official notice does not disclose the actor's precise first and last moments of access. The incident date is based on the earliest technical activity that can be verified from public sources. The September 19 scope finding, October 30 public notice, and October 31 HHS report are separate stages.

The official notice lists names, Social security numbers, dates of birth, medical or health information, healthcare treatment or diagnostic information, health-insurance information, billing or payment information, and tax or financial information as possible fields.

Scope varies by person, and it should not be assumed that every field was present for everyone. Although the organization says files were acquired, that does not establish that every field appeared in every file or that all people were affected by every data type. Attacker-claimed samples are not used to expand the primary data categories.

The organization specifically says there was no evidence of access to its current electronic medical-record system. This boundary matters: acquisition of certain files containing health information does not mean the entire active EMR system was entered or that the whole clinical database was copied.

The LeakData description and tags preserve that distinction. Health, treatment, and diagnosis information are listed based on the official file review, while “electronic medical record” is not added as a separately affected system. Recipients should rely on their individual letters to understand which fields were associated with them.

200,000 is the affected-person count published in the HHS/OCR portal; it is not a file, document, or leak-row count. The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person.

The “200K+” wording in secondary headlines is not added as another total. The current federal row's 200,000 is retained as the single official person metric.

Tri-Century said it implemented stronger password requirements, more frequent password changes, reduced access permissions, and offline storage of older data. HHS and the FBI were notified. The organization established the 1-800-405-6108 call center, available weekdays from 8:00 a.m. to 8:00 p.m. Eastern Time.

Recipients should regularly review financial accounts, credit reports, and health-insurance Explanation of Benefits documents. An unfamiliar treatment, claim, bill, or payment should be verified directly with the relevant institution. Unexpected communications claiming to represent Tri-Century should not receive a full SSN, health information, password, payment details, or one-time code. If a suspicious message or account event appears, it should be verified through the organization’s current official contact channel without using links in the message. When an individual notification letter is available, it is the primary source for the person-specific data scope and protection options offered. Dates and data categories should be interpreted only to the extent supported by public sources; undisclosed details should not be treated as confirmed.