American Vision Partners Settles $1.75M Data Breach Lawsuit Affecting Over 2.2 Million Patients
Medical Management Resource Group LLC (MMRC), operating as American Vision Partners, has agreed to a $1.75 million settlement in a class action lawsuit following a 2023 data breach that exposed sensitive patient information. The breach was first detected on November 14, 2023, when suspicious activity was identified in the company’s systems. A forensic investigation confirmed on December 6, 2023, that an unauthorized third party had accessed and exfiltrated files containing patient data.
The compromised information included names, contact details, dates of birth, medical records, medications, and, for a subset of individuals, Social Security numbers. The breach was reported to the HHS Office for Civil Rights (OCR) on February 6, 2026, initially affecting 2.35 million individuals, though the figure was later adjusted to 2,264,157. However, the lawsuit cites approximately 1.6 million Americans as impacted.
Multiple class action lawsuits were consolidated into a single case Hulewat et al. v. Medical Management Resource Group LLC d/b/a American Vision Partners filed in the U.S. District Court for the District of Arizona. The lawsuit names several co-defendants, including Barnet Dulaney Perkins Eye Center, Southwest Eye Institute, Southwestern Eye Center, and Wellish Vision Institute, though the latter two were later dismissed.
Plaintiffs allege that the breach resulted from inadequate cybersecurity measures, including failures to implement industry-standard protections. Claims include negligence, breach of contract, unjust enrichment, and violations of the Arizona Consumer Fraud Act.
Under the settlement, a $1.75 million fund will cover attorneys’ fees, administrative costs, and payments to class members. Affected individuals are divided into two subclasses:
- Damages Subclass (258,070 individuals) – Those whose Social Security numbers were exposed may claim up to $3,000 for documented losses or a pro rata cash payment.
- Injunctive Relief Subclass (all affected individuals) – Will benefit from enhanced cybersecurity measures, including the appointment of a Chief Information Security Officer (CISO) and additional protections valued at $2.79 million.
Key deadlines include October 13, 2026, for objections or opt-outs, November 12, 2026, for claim submissions, and a final fairness hearing on December 10, 2026. The settlement awaits final court approval.
American Vision Partners cybersecurity rating report: https://www.rankiteo.com/company/american-vision-partners
"id": "AME1787927376",
"linkid": "american-vision-partners",
"type": "Breach",
"date": "11/2023",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '2,264,157',
'industry': 'Healthcare',
'location': 'United States',
'name': 'Medical Management Resource Group LLC (MMRC) '
'd/b/a American Vision Partners',
'type': 'Healthcare Provider'},
{'industry': 'Healthcare',
'location': 'United States',
'name': 'Barnet Dulaney Perkins Eye Center',
'type': 'Healthcare Provider'},
{'industry': 'Healthcare',
'location': 'United States',
'name': 'Southwest Eye Institute',
'type': 'Healthcare Provider'},
{'industry': 'Healthcare',
'location': 'United States',
'name': 'Southwestern Eye Center',
'type': 'Healthcare Provider'},
{'industry': 'Healthcare',
'location': 'United States',
'name': 'Wellish Vision Institute',
'type': 'Healthcare Provider'}],
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '2,264,157',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (medical records, Social '
'Security numbers)',
'type_of_data_compromised': ['Names',
'Contact details',
'Dates of birth',
'Medical records',
'Medications',
'Social Security numbers']},
'date_detected': '2023-11-14',
'date_publicly_disclosed': '2026-02-06',
'description': 'Medical Management Resource Group LLC (MMRC), operating as '
'American Vision Partners, has agreed to a $1.75 million '
'settlement in a class action lawsuit following a 2023 data '
'breach that exposed sensitive patient information. The breach '
'was first detected on November 14, 2023, when suspicious '
'activity was identified in the company’s systems. A forensic '
'investigation confirmed on December 6, 2023, that an '
'unauthorized third party had accessed and exfiltrated files '
'containing patient data. The compromised information included '
'names, contact details, dates of birth, medical records, '
'medications, and, for a subset of individuals, Social '
'Security numbers. The breach was reported to the HHS Office '
'for Civil Rights (OCR) on February 6, 2026, initially '
'affecting 2.35 million individuals, though the figure was '
'later adjusted to 2,264,157. Multiple class action lawsuits '
'were consolidated into a single case, alleging inadequate '
'cybersecurity measures and violations of the Arizona Consumer '
'Fraud Act.',
'impact': {'data_compromised': 'Names, contact details, dates of birth, '
'medical records, medications, Social Security '
'numbers (subset)',
'financial_loss': '$1.75 million settlement',
'identity_theft_risk': 'High (Social Security numbers exposed)',
'legal_liabilities': 'Class action lawsuit, violations of Arizona '
'Consumer Fraud Act'},
'investigation_status': 'Settled (awaiting final court approval)',
'post_incident_analysis': {'corrective_actions': 'Appointment of a CISO, '
'enhanced cybersecurity '
'protections valued at $2.79 '
'million',
'root_causes': 'Inadequate cybersecurity measures'},
'recommendations': 'Enhanced cybersecurity measures, appointment of a Chief '
'Information Security Officer (CISO)',
'references': [{'source': 'Class action lawsuit settlement'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit',
'regulations_violated': ['Arizona Consumer Fraud '
'Act'],
'regulatory_notifications': 'Reported to HHS Office '
'for Civil Rights '
'(OCR)'},
'response': {'third_party_assistance': 'Forensic investigation'},
'threat_actor': 'Unauthorized third party',
'title': 'American Vision Partners Settles $1.75M Data Breach Lawsuit '
'Affecting Over 2.2 Million Patients',
'type': 'Data Breach',
'vulnerability_exploited': 'Inadequate cybersecurity measures'}