Andover Eye Associates Data Breach 2025: 1,638 Affected · Email Account Compromise · MA. Filed With HHS OCR. What To Do.

Andover Eye Associates — a multi-specialty ophthalmology practice in Andover, Massachusetts — reported a 2025 email-account compromise to the U.S. Department of Health and Human Services Office for Civil Rights affecting 1,638 individuals. Unauthorized access occurred on May 28, 2025, was detected on June 10, 2025, and the practice mailed individual notification letters and filed with state attorneys general beginning December 31, 2025. Reported affected counts include at least 1,291 Massachusetts residents and 237 New Hampshire residents.

Timeline

• May 28, 2025 — An unauthorized actor accessed at least one of two employee email accounts.
• June 10, 2025 — Andover Eye Associates detected suspicious activity in the two mailboxes, secured the accounts, and engaged outside forensic counsel.
• November 4, 2025 — Forensic review concluded that the affected mailboxes contained sensitive personal and protected health information.
• December 31, 2025 — Reported to HHS OCR and to the Massachusetts and New Hampshire attorneys general.
• January 2, 2026 — Individual notification letters mailed; substitute notice published.

What was exposed

According to the entity’s notification and state filings, the affected mailboxes contained:

• Full name
• Social Security number
• Address
• Medical information

The practice has not publicly attributed the intrusion to a named threat actor, ransomware group, or phishing campaign. The HHS OCR portal categorizes the incident as a hacking/IT incident with the breach location listed as Email.

What Andover Eye Associates is offering

The practice is providing affected individuals with one year of complimentary credit monitoring through Epiq Global, along with instructions on placing fraud alerts and credit freezes. The notification letter includes the dedicated enrollment code each recipient needs to activate the service.

Class-action status

No class action complaint has been filed on the public docket as of this writing. The plaintiffs’ firm Strauss Borrelli PLLC has publicly announced an investigation on behalf of affected individuals, which typically precedes — but does not guarantee — a complaint.

What to do if you may be affected

• Read the notification letter carefully. It lists the specific data elements exposed in your record and the enrollment code for the credit-monitoring service. Both vary by individual.
• Enroll in the offered credit monitoring before the deadline printed on the letter. It is free and does not waive any legal rights.
• Freeze your credit with all three nationwide consumer reporting agencies (Equifax, Experian, TransUnion). Freezes are free, take roughly ten minutes per bureau, and are more protective than monitoring alone — especially because Social Security numbers were exposed in this incident.
• Watch for medical-identity misuse. Review explanation-of-benefits statements from your health insurer for services you did not receive, and request a copy of your medical record from Andover Eye Associates if you suspect tampering.
• Be skeptical of follow-up calls or emails referencing this breach. Confirm anything by calling the number printed on your notification letter rather than a number provided in an inbound message.

Sources on this page

• HHS Office for Civil Rights Breach Portal — federal regulatory record.
• Strauss Borrelli PLLC investigation notice — plaintiffs’ firm summary of dates and exposed data.
• ClaimDepot case file — state-level affected counts and credit-monitoring vendor.
• HIPAA Journal — December 2025 Healthcare Data Breach Report — trade-press coverage of the filing.
• Massachusetts Data Breach Notification Letters — December 2025 — state AG record of filed notification letters.