EyeMed data breach lawsuit (misdirected member email, September 2026)

EyeMed Vision Care, a large vision benefits company, is facing a proposed class action after it disclosed that a file of member information, including Social Security numbers, was emailed to the wrong person.

The case is Buonsante v. EyeMed Vision Care, LLC, No. 1:26-cv-01096, filed October 26, 2026, in the U.S. District Court for the Southern District of Ohio and assigned to Judge Susan J. Dlott. It seeks damages and long-term credit monitoring for people whose information was exposed.

The lawsuit is at the very first stage. EyeMed has not responded in court, no class has been certified, and there is no settlement or claim form.

EyeMed Vision Care, LLC is a Cincinnati-based vision insurance and benefits company. It manages vision benefit plans that cover routine eye exams, prescription glasses and contact lenses, and says it has America's largest network of eye doctors. Its network includes LensCrafters, Pearle Vision and Target Optical.

Christie Buonsante is the named plaintiff. According to a Top Class Actions summary of her complaint, she is an EyeMed policyholder who had to give her name and Social Security number to get services.

Markovits, Stock & DeMarco LLC (Terence R. Coates, Dylan J. Gould and Spencer D. Campbell) and Milberg PLLC (Mariya Weekes) represent her.

Kroll is the company EyeMed hired to provide free identity monitoring to affected members. It is not a party.

According to EyeMed's notice letter and state filings:

• September 22, 2026: EyeMed sent a file containing member information to an incorrect email address. EyeMed says it identified the mistake the same day.
• After a brief investigation: EyeMed concluded the incident was human error, not malicious, limited to a single email, and that its systems, network and applications were not compromised.
• October 23, 2026: EyeMed reported the incident to the Vermont Attorney General, according to Top Class Actions.
• October 26, 2026: The lawsuit was filed in Cincinnati federal court.
• Late October to early November 2026: EyeMed's notice letter was posted by the California Attorney General's office, and a Texas filing was also reported. The HIPAA Journal reported on November 4 that at least 500 California residents were affected.

EyeMed's letter says the exposed information varies by person but may include name, address, date of birth, Social Security number and member identification number. A law firm summarizing a Texas Attorney General posting reported 19,425 people affected in total, including 1,733 Texans, and said the Texas listing also mentions health insurance information. EyeMed has not published a total itself in the notices Class Action Pulse reviewed.

This is not EyeMed's first breach case. EyeMed agreed to a $5 million class settlement over a June 2020 data breach and paid $2.5 million in 2023 to resolve a four-state investigation of that breach, which affected about 2.1 million people, according to the Oregon Department of Justice as reported by Top Class Actions.

The plaintiff alleges that EyeMed failed to protect members' sensitive information and was too slow to notify them. According to Top Class Actions, the complaint says, "Had [EyeMed] properly monitored its IT networks, it would have discovered the breach sooner," and that "immediate notification of a data breach is critical so that those impacted can take measures to protect themselves."

She says she has received more spam calls, texts and emails since the incident, has spent hours checking accounts and credit reports and changing passwords, and has felt fear, anxiety and stress. She brings claims for negligence, negligence per se, breach of implied contract and unjust enrichment.

EyeMed says in its notice letter that the incident was a single misdirected email caused by human error, that it was caught the same day, and that its systems were not compromised. It says it is revising its privacy and operations policies, revising training and retraining staff. It is offering free Kroll identity monitoring, including credit monitoring, fraud consultation and identity theft restoration.

Readers should notice the gap between the two accounts. The complaint, as summarized, frames the case around network monitoring, while EyeMed describes a misdirected email with no system intrusion. The court has not decided which framing fits or whether the information was misused. Class Action Pulse did not obtain the complaint itself.

Nothing has been decided. The court has not ruled on whether EyeMed was negligent, whether the plaintiff was harmed, or whether a class should be certified. EyeMed has not filed a response.

The complaint, as described by Top Class Actions, proposes a nationwide class. The court has not approved it.

• Who: All individuals whose private information was accessed or acquired by an unauthorized party in the EyeMed incident.
• Signal: People who received an EyeMed "Notice of Data Privacy Incident" letter about the September 22, 2026 email.
• Plan members: The letter went to people enrolled in vision benefit plans EyeMed manages.
• Not covered: People whose information was not in the misdirected file.

The exact class wording, including any exclusions, could not be confirmed without the complaint.

1. Keep your EyeMed letter. It holds your Kroll membership number and enrollment deadline.
2. Enroll in the free monitoring at enroll.krollmonitoring.com before the deadline in your letter. Enrolling does not waive your right to join a class action.
3. Call EyeMed's line at (844) 971-8613, Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern, with questions.
4. Watch your credit reports and explanations of benefits for anything you do not recognize, and consider a credit freeze.
5. Write down any unusual calls, texts or fraud and any time or money spent dealing with it.

You can also use the form on this page to ask about the case. A Class Action Pulse inquiry is only an inquiry. It does not join the lawsuit or create a lawyer relationship.

No money is available now. The lawsuit asks for damages and court orders including lifetime credit monitoring and identity theft insurance. Any payment would come only from a court-approved settlement or a judgment. The Kroll monitoring EyeMed is offering is separate from the lawsuit and is available now.

• September 22, 2026: Misdirected email.
• October 26, 2026: Complaint filed.
• Your letter: Kroll enrollment deadline.

There is no claim, opt-out or objection deadline in the lawsuit. You keep all your rights.

• Misdirected email: An email sent to the wrong recipient. Here, EyeMed says one file went to an incorrect address.
• Negligence per se: A claim that a company was careless because it allegedly broke a law or regulation meant to protect people like the plaintiff.
• Implied contract: A promise the law infers from the parties' conduct, such as protecting data collected as a condition of service.
• Identity monitoring: A service that alerts you to changes in your credit file or signs your information is being misused.
• Credit freeze: A free block that stops new credit from being opened in your name without your permission.
• Class certification: A court's decision that a case may proceed on behalf of a group.

EyeMed will likely respond with an answer or a motion to dismiss, which often argues that a plaintiff has not shown real harm. Other people may file similar suits, and related cases are sometimes combined. Several law firms have announced investigations of the incident. Class Action Pulse will update this page as the court acts.

This page relies on EyeMed's notice letter template posted by the California Attorney General, the federal court docket, EyeMed's company page, and reporting by Top Class Actions and The HIPAA Journal. The complaint was not available, so its allegations and quotes come from Top Class Actions. The affected total and the Texas figures come from a law firm's summary of a state filing and were not confirmed with the state. EyeMed's letter does not state how long the Kroll monitoring lasts.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.