The 2026 EyeMed data breach: a file with Social Security numbers went to the wrong email
Nobody broke in this time. An EyeMed employee sent member records to the wrong address, and for some people the file included a Social Security number. Here is what the notice says and what is worth doing.
On 22 September 2026 EyeMed Vision Care emailed a file of member information to an incorrect address. Depending on the person, it held name, address, date of birth, Social Security number and EyeMed member ID. EyeMed says it was human error, caught the same day, and its systems were not breached. It has not said how many people were in the file. Affected members are getting letters with free Kroll identity monitoring. Enroll, freeze your credit at the three bureaus, and get an IRS Identity Protection PIN.
What is confirmed, and what is still open
The middle column is what EyeMed’s own notice and its regulator filing say. The right column adds what breach trackers report and what EyeMed has left unsaid.
| Question | What EyeMed says | Detail and open questions |
|---|---|---|
| What happened | On 22 September 2026 EyeMed emailed a file containing member information to the wrong email address. EyeMed calls it human error, not an attack. | EyeMed has not said who received the file, or whether it was deleted or got any further. |
| When it was found | The same day. EyeMed says the incident was limited to that one email and its systems were not compromised. | EyeMed has not published when letters were mailed. Its earliest state filing listed by breach trackers is dated 23 October. |
| What was in the file | Varies by person, but may include name, address, date of birth, Social Security number and EyeMed member ID number. | A Texas filing described by ClassAction.org also mentions health insurance information. |
| How many people | Not disclosed by EyeMed. | The California filing means at least 500 Californians (the state’s reporting threshold). Law-firm sites say the Vermont filing lists 14 residents. |
| Regulators | Reported to the California Attorney General on 30 October 2026. | Breach trackers list a Vermont filing on 23 October and a Texas filing on 28 October 2026. |
| What EyeMed offers | Free identity monitoring through Kroll (single-bureau credit monitoring, fraud consultation, identity restoration). | The length of the service and the enrollment deadline are printed in each letter. |
Sources: EyeMed’s sample notice letter and breach report filed with the California Attorney General (30 October 2026); ClassAction.org, Claim Depot and an Edelson Lechtzin press release on GlobeNewswire (26–28 October 2026). Status as of 5 November 2026.
1. What happened, in order
EyeMed Vision Care manages vision benefits for employers and health plans, so many members know it only as the name on their eye-exam coverage. On 22 September 2026 someone at EyeMed sent a file of member information to the wrong email address. EyeMed says it caught the mistake the same day. It reported the incident to state regulators in late October, starting with Vermont on 23 October and California on 30 October, and began mailing letters. Law firms picked up the filings and started advertising on 26 October.
2. A misdirected email is a smaller risk, not a zero risk
This is not the usual story of criminals copying a database and selling it. One file went to one person who was never meant to see it. Most of the time that recipient deletes it or reports it. The trouble is that EyeMed has not said who received it, and a file with names, dates of birth and Social Security numbers stays useful for years. You do not need to panic. You do need to do the one thing that matters for a leaked Social Security number: freeze your credit.
3. Freeze your credit at all three bureaus
A freeze at Equifax, Experian and TransUnion is free and stops lenders pulling your file, which blocks most new accounts opened in your name. It takes about ten minutes per bureau online and does not affect your score or your existing cards. Lift it for a day when you apply for credit yourself. Kroll’s monitoring is worth enrolling in too, but it only tells you after someone has tried; the freeze stops them. Our guide on what to do after a data breach walks through each bureau.
4. Get an IRS Identity Protection PIN before tax season
A Social Security number plus a date of birth is what a fraudster needs to file a tax return in your name and collect the refund before you do. The IRS issues a six-digit Identity Protection PIN to anyone who verifies their identity on IRS.gov, and returns filed without it are rejected. Getting one now, before the 2027 filing season opens, closes that door. It is free, and a new PIN arrives each year.
5. Calls about “your EyeMed breach”
News of a breach brings people who pretend to be the company, a law firm or a “settlement office”. A caller who knows your member ID or birthday proves nothing; that is exactly what was in the file. EyeMed’s letter does not ask you to call anyone except its own call center, and enrollment in Kroll happens online with the code in the letter. If someone asks for a fee to “file your claim”, there is no claim to file. Our guide to telling a real breach letter from a fake has more.
6. The 2020 EyeMed breach and its settlement
Much of what comes up when you search for “EyeMed data breach” is about 2020, when a phishing attack opened an EyeMed email account holding the information of about 2.1 million people. That case was settled for $5 million. If you were in it, you were notified at the time; the claim period is over. Our list of data breach settlements still open for claims shows which payouts you can still apply for.
Your address and birthday were already out there
You cannot see the file EyeMed sent. You can see the people-search sites that publish your home address, age, phone number and relatives for anyone who types your name. That is where a scammer fills in the rest. PersProtect looks for your details on those sites, checks your email against known breach databases, and files the removals.
Check my exposure — free →The EyeMed breach, answered
Was EyeMed hacked in 2026?
No, not according to EyeMed. Its notice says an employee sent a file with member information to an incorrect email address on 22 September 2026, that the mistake was spotted the same day, and that its systems, network and apps were not compromised. The file did include Social Security numbers for some people, which is why letters and law-firm ads followed.
I got a letter from EyeMed about a data privacy incident. Is it real?
Very likely. The genuine notice is headed “Notice of Data Privacy Incident”, is signed by EyeMed’s privacy officer, offers identity monitoring through Kroll with an enrollment code, and gives a call center number, (844) 971-8613, open weekdays 9:00 am to 6:30 pm Eastern. Enroll through the address printed in the letter. A real letter never asks you to pay or to read out your full Social Security number on a call you did not place.
How do I know if my information was in the EyeMed file?
Only EyeMed can tell you. The file went to one wrong recipient, not to a public leak site, so it is not in the known breach databases that email checkers search. If you have vision coverage managed by EyeMed and want to know whether you were included, call the number above and ask.
Should I sign up for the free Kroll monitoring?
Yes, it costs nothing and alerts you to new credit activity at one bureau. It does not stop anyone opening an account in your name, though. A credit freeze at all three bureaus does that, and you can have both at once.
Is there an EyeMed class action for the 2026 breach?
Not one you can join yet. Since 26 October 2026 several law firms have advertised investigations, which means they are looking for clients. Nothing has been filed that requires you to sign up to keep your rights. If a settlement happens later, people in the class get notice and a claim form.
Is this the same as the 2020 EyeMed breach?
No. In 2020 an attacker got into an EyeMed email account in a phishing attack, and the information of about 2.1 million people was involved. That case ended in a $5 million class settlement. The 2026 incident is a separate event with a different cause, and being part of one tells you nothing about the other.
One email went astray. Your public profile goes everywhere.
See which people-search sites publish your address, phone number and relatives. It is free and takes about a minute.
Run my free exposure scan →