EyeMed Data Breach Settlement: $5M

Consumers who were sent a breach notification letter from EyeMed Vision Care indicating their personal data was potentially exposed during the June 2020 unauthorized system access.

Individuals claiming reimbursement for financial losses must provide supporting records such as bank or credit card statements, invoices, credit reports or receipts showing breach-related expenses.

One of the nation's largest vision insurance administrators has agreed to establish a $5 million fund to compensate consumers affected by a cyberattack that occurred nearly five years ago.

EyeMed Vision Care, which manages eye care benefits for over 100 million members globally, faced legal action after hackers infiltrated its systems in summer 2020.

The breach came to light when the company discovered that an outside party had penetrated its email system and potentially viewed or downloaded files containing member information. Those whose records were at risk subsequently received letters alerting them to the incident and outlining steps to protect themselves.

The compromised data spanned a broad range of personal details. Legal filings indicate the intruder may have accessed member names, home addresses, email addresses, birth dates, vision insurance account numbers, government health program identifiers such as Medicare and Medicaid numbers, and state-issued identification credentials including driver's licenses.

Attorneys representing affected consumers argued that EyeMed operated with inadequate digital safeguards despite the sensitivity of the health data it maintained. The lawsuit alleged that common security practices could have blocked the unauthorized access or at least limited the scope of the exposure.

EyeMed contested these claims and has not accepted responsibility for the incident. However, the company chose to resolve the matter through a negotiated settlement rather than continue defending against the litigation in court.

Settlement Benefits for Class Members

Qualifying consumers may recover compensation through several avenues under the settlement agreement.

Those who experienced direct financial consequences from the breach can submit claims for actual expenses up to $10,000.

Eligible costs include money lost to fraudulent activity that was never reimbursed, fees paid to professionals such as accountants or attorneys for breach-related assistance, charges for credit reports or monitoring services, and other miscellaneous costs tied to protecting or restoring one's identity.

Separately, class members may seek payment for personal time devoted to addressing the breach. The settlement allows claims for up to four hours at a rate of $25 per hour, providing a maximum of $100 for time-based compensation.

Combined with the documented loss cap, the total potential recovery reaches $10,150 per claimant.

Consumers who did not suffer specific monetary harm but were nonetheless affected by the breach may qualify for a residual payment drawn from leftover settlement funds.

Preliminary estimates place this amount at roughly $50, although the actual figure will fluctuate based on claim volume and total documented losses paid out.