Cohen’s Fashion Optical Sued Over Data Breach That Exposed Customer Information

Case Overview: The lawsuit claims Cohen’s Fashion Optical failed to secure customer data, allowing hackers to steal personal and health information in a 2025 ransomware attack.

Consumers Affected: Customers whose personal and medical details were stored in Cohen’s systems at the time of the breach.

Court: U.S. District Court for the Eastern District of New York

Cohen’s Fashion Optical failed to secure sensitive customer information, allowing a cybercriminal group to break into its systems and steal personal and health-related data, a new lawsuit claims. 

The lawsuit claims the company’s “lax security” opened the door to hackers, who then accessed files containing unencrypted Social Security numbers, medical details, and other information customers provided for eye exams and prescription eyewear.

Reportedly, the breach occurred around October 28, 2025, when the ransomware group Sinobi allegedly accessed the company’s internal network and took control of customer files. 

Sinobi allegedly threatened to release all stolen data if negotiations failed, a tactic the lawsuit says reflects the group’s increasingly aggressive approach. The filing also claims the stolen information is already circulating on the dark web and may continue to be sold or misused for years.

Hackers Allegedly Stole Personal and Health Data from Cohen’s Servers

Brooklyn resident Efren Sanchez, who brought the lawsuit, says he had to provide sensitive personal information to Cohen’s as a condition of receiving care and purchasing eyewear. 

He believed the company would follow industry standards and basic cybersecurity practices to protect that data. Instead, the suit says his information remained stored on unencrypted servers and was left vulnerable to intruders.

After learning of the breach, Sanchez began monitoring his accounts and taking steps to guard against fraud, efforts the lawsuit describes as time-consuming and ongoing. 

The complaint says he has suffered a range of harms, from invasion of privacy and the theft of his personal data to lost time, emotional distress, and a heightened risk of identity theft that may last for years.

It further notes that Cohen’s has not publicly disclosed the breach, adding to the uncertainty surrounding what was taken and how it may be used.

Plaintiff Says Company Ignored Basic Cybersecurity Standards

Cohen’s is accused of falling short of basic security obligations even while collecting and storing highly sensitive personal information from customers across more than 100 locations.

The suit contends the company ignored established privacy commitments and industry standards, failed to encrypt stored data, and kept customer information longer than necessary.

Plaintiffs also point to noncompliance with federal guidance, citing longstanding recommendations from the FTC and FBI that emphasize how proper safeguards can prevent ransomware incidents.

The filing maintains that the company knew, or reasonably should have known, it faced a heightened risk, citing years of increasing data breaches throughout the retail and healthcare sectors.

It adds that Cohen’s alleged lapses carry serious consequences, as unencrypted information is quickly sold on dark-web marketplaces where cybercriminals assemble detailed identity packages used in fraud schemes.

Data Breach Lawsuits Continue Across Healthcare and Retail Industries

The case is one of a number of recently filed lawsuits accusing companies of mishandling consumer data. Major League Baseball is facing claims that its digital ticketing platform failed to secure fans’ accounts, allegedly allowing widespread breaches and ticket theft. 

Union Home Mortgage is accused of exposing thousands of borrowers’ financial details due to inadequate security measures. Allianz Life Insurance and Victoria’s Secret are fighting class actions tied to large breaches affecting millions of consumers. 

Healthcare organizations and insurers, including Cooper University Health Care and Globe Life, are also under scrutiny, reflecting how frequently attackers target industries holding sensitive medical and personal records.

In the Cohen's Fashion Optical data breach class action lawsuit, Sanchez wants to represent anyone in the country whose information was compromised in the breach.

He is asking the court to order Cohen’s to strengthen its security measures, notify those affected, and compensate individuals for the harm and ongoing risks associated with the incident.

The requested relief additionally calls for system upgrades, improved safeguards, and reimbursement for the losses and time customers have incurred while dealing with the breach.

Case Details

• Lawsuit: Sanchez v. Cohen’s Fashion Optical of America, Inc.
• Case Number: 2:25-cv-06261
• Court: U.S. District Court for the Eastern District of New York 

Plaintiffs' Attorney:

• Leanna A. Loginov and Andrew Shamis (Shamis & Gentile, P.A.)

Were you affected by the Cohen’s Fashion Optical data breach? Share your experience in the comments below.