Columbia Eye Clinic Data Breach 2025: Network Intrusion · SC. Filed With HHS OCR. What To Do.

Columbia Eye Clinic — a medical and surgical ophthalmology practice with four locations in Columbia and Lexington, South Carolina — reported a January 2025 network intrusion to the U.S. Department of Health and Human Services Office for Civil Rights. The practice detected an information-technology network disruption on January 13, 2025, determined that an unauthorized actor had accessed files between January 9 and January 13, 2025, and filed the breach with HHS OCR on March 14, 2025. The initial OCR filing listed 500 affected individuals; the practice has described the figure as preliminary while completing its e-discovery review.

Timeline

• January 9, 2025 — Unauthorized actor entered the Columbia Eye Clinic network and may have accessed certain files.
• January 13, 2025 — Network disruption detected. The practice contained the incident, engaged outside cybersecurity counsel, and notified law enforcement.
• March 14, 2025 — Breach reported to HHS OCR (initial count: 500 individuals) and state attorneys general; substitute notice posted to the practice website and individual notification letters mailed as the e-discovery review identified specific records.

What was exposed

According to Columbia Eye Clinic’s substitute notice and notification letters, the affected files may have contained the following, varying by individual:

• Name
• Contact information
• Date of birth
• Procedure codes
• Information used to obtain pre-approval for eye-related procedures

The practice has stated that the electronic medical record system and practice management systems themselves were not compromised. Some plaintiffs’ firms have characterized the broader category of exposed data as potentially including Social Security numbers, driver’s license numbers, financial-account numbers, and health-insurance information, but Columbia Eye Clinic’s own notice does not enumerate those elements. We have followed the entity’s published notice for the data list above; the trade-press and class-action-investigation sources are linked below for reference.

What Columbia Eye Clinic is offering

Columbia Eye Clinic’s substitute notice does not advertise complimentary credit monitoring. Recipients should consult the individual notification letter mailed to them — credit-monitoring offers and enrollment instructions, where extended, are typically provided in the letter rather than in the public notice. The practice has published a dedicated incident hotline at 1-800-298-2295 (Monday-Friday, 9:00 a.m. to 5:30 p.m. ET) for questions.

Class-action status

Multiple plaintiffs’ firms — including Console & Associates P.C. and the firm operating databreachclassaction.io — have publicly announced investigations into the Columbia Eye Clinic breach and are accepting inquiries from affected patients. No filed class-action complaint has been located on the public docket as of this update; investigations typically precede, but do not guarantee, a complaint.

What to do if you may be affected

• Read your notification letter carefully. It lists the specific data elements exposed in your record and any credit-monitoring enrollment code. Both vary by individual.
• If you receive a credit-monitoring offer, enroll before the printed deadline. Enrollment is free and does not waive any legal rights.
• Freeze your credit with all three nationwide consumer reporting agencies (Equifax, Experian, TransUnion). Freezes are free, take roughly ten minutes per bureau, and are the single highest-leverage step against identity theft.
• Watch for medical-identity misuse. Review explanation-of-benefits statements from your health insurer for services you did not receive, and request a copy of your medical record from Columbia Eye Clinic if you suspect tampering.
• Be skeptical of follow-up calls or emails referencing this breach. Confirm anything by calling the practice’s published incident hotline rather than a number provided in an inbound message.

Sources on this page

• HHS Office for Civil Rights Breach Portal — federal regulatory record of the filing.
• Columbia Eye Clinic — Notice of Data Security Incident — the entity’s own substitute notice, including the published incident timeline and data-element list.
• JD Supra / Console & Associates — Columbia Eye Clinic Confirms January 2025 Data Breach — plaintiffs’-firm summary of the notification mailing.
• Database Breach Class Action — Columbia Eye Clinic Investigation — class-action investigation announcement.
• Console & Associates P.C. — Columbia Eye Clinic Data Breach Investigation — secondary plaintiffs’-firm case page.