Financial data wiped from US eye clinics, over 300k people affected

An alleged ransomware attack on a physicians' management service provider has left more than 300,000 individuals affected.

The notice to affected clients stated that on or around June 3rd, 2023, Panorama Eyecare, a Colorado-based management service provider for clinics, detected unauthorized access to its internal network.

The company partners with ten eye physician practices to provide management services, such as financial, IT, business management, and HR solutions. This means that the breach may have impacted other clinics. However, the notice does not specify whether this is the case. Cybernews has reached out to the company, but a response is yet to be received.

The company’s investigation showed that threat actors had access to the network between May 22nd, 2023, and June 4th, 2023. The Office of the Maine Attorney General states that 377,911 people were affected by the hack.

Reportedly among the stolen data was financial information, including:

• Financial account number
• Credit/debit card number
• Security code
• Access code
• Password
• PIN for the account

Panorama Eyecare claimed that, so far, there is no evidence that the incident resulted in the use of any of the patient’s data for identity theft or financial fraud.

Despite the claim, the company has offered affected individuals credit monitoring and identity theft protection services free of charge for 12 months.

The reported data leak could be the result of a ransomware attack. On July 15th, 2023, the Russia-linked LockBit gang listed the company as a victim on its website on the Dark Web.