HealthConsent
Active breach tracker Orem, UT Disclosed March 19, 2026

Orem Eye Clinic Data Breach 2026 (NightSpire Ransomware): 5,800 Utah Optometry Patients Exposed. 1 TB Exfiltrated. What To Do

Complete Eye Care (d/b/a Orem Eye Clinic), a Utah optometry and ophthalmology practice, was attacked by the NightSpire ransomware group in January 2026. NightSpire claims 1 TB of data exfiltrated. 5,800 patients exposed; the practice has not posted a substitute breach notice. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Jan 26, 2026

NightSpire posts Orem Eye Clinic / OEC Medical Systems to Tor leak site; claims 1 TB exfiltrated

Jan 26, 2026

Attacker gained access

Jan 26, 2026

Breach detected

Mar 19, 2026

Reported to HHS OCR as Hacking/IT Incident at Network Server

Data exposed

01

High-risk identity

Enables financial + identity theft

Date of birth (per third-party tracker) Social Security number (per third-party tracker)

02

Health records

Don't expire and can't be reissued

Medical records / diagnoses / treatment (per third-party tracker) Prescription details (per third-party tracker)

03

Contact & insurance

Phishing + targeted scams

Full name (specific PHI categories not entity-confirmed) Address (per third-party tracker) Financial account information (per third-party tracker) Health insurance information (per third-party tracker)

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Mason LLP (actively soliciting affected individuals) Shamis & Gentile P.A. (publicly investigating) Federman & Sherwood (publicly investigating)
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Orem Eye Clinic is an independent optometry and ophthalmology practice at 742 N 530 E in Orem, Utah. It operates under the legal entity Complete Eye Care (also known as OEC Medical Systems, Inc.).

On January 26-27, 2026, the NightSpire ransomware group posted Orem Eye Clinic / OEC Medical Systems to its Tor leak site, claiming to have exfiltrated 1 TB of data and threatening full publication absent contact.

The practice reported the incident to HHS OCR on March 19, 2026 as a Hacking/IT Incident at Network Server — confirming 5,800 affected individuals.

NightSpire is a ransomware-as-a-service group operating a double-extortion model. Known tactics include RDP-based intrusions and living-off-the-land tooling. The group has been active throughout 2025-2026 against small-to-mid-size healthcare organizations.

Why this page is sparse

As of mid-May 2026, Orem Eye Clinic has not posted a substitute breach notice on its public website. No credit-monitoring offer is visible to the public. Patients are directed to the practice’s main line at 801-224-4799.

If you receive a notification letter, it will list the specific data elements involved in your case and any monitoring services offered.

What was potentially exposed

Per third-party trackers (entity-confirmed PHI categories are not yet public):

  • Full name, address, date of birth
  • Social Security number
  • Financial account information
  • Medical records, diagnoses, treatment information
  • Prescription details
  • Health insurance information

NightSpire’s claim references a 1 TB exfiltration volume — large for a practice of this size, suggesting extensive image and EHR data may be involved.

What to do

  1. Call Orem Eye Clinic at 801-224-4799 and ask whether they have mailed a substitute notice and what monitoring is offered.
  2. Place free credit freezes at Equifax, Experian, TransUnion. SSN exposure is likely.
  3. File IRS Form 14039.
  4. Pull your free annual credit reports at annualcreditreport.com and monitor for unfamiliar accounts.
  5. Stop the ongoing flow of your optometry data. HealthConsent files HIPAA restriction requests so the vision-care, prescription, and image data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.