[BreachExchange] Luxottica data breach exposes LensCrafters, EyeMed patient info

[Destry Winant]

https://www.bleepingcomputer.com/news/security/luxottica-data-breach-exposes-lenscrafters-eyemed-patient-info/

A Luxottica data breach has exposed the personal and protected health
information for patients of LensCrafters, Target Optical, EyeMed, and
other eye care practices.

Luxottica is the world's largest eyewear company with a portfolio of
well-known eyeglass brands, including Ray-Ban, Oakley, Oliver Peoples,
Ferrari, Michael Kors, Bulgari, Armani, Prada, Chanel, and Coach.


In addition to selling eyeglasses, Luxottica also operates the EyeMed
vision benefits company and partners with eye care professionals as
part of their LensCrafters, Target Optical, EyeMed, and Pearle Vision
retail outlets.

These partners get access to a web-based appointment scheduling
application that allows patients to schedule appointments online or
over the phone.

Data breach in the appointment scheduling system

In a "Security Incident" notification issued this week, Luxottica
disclosed that their appointment scheduling application suffered a
data breach after being hacked on August 5th, 2020.

Luxottica states that they first learned about this breach on August 9
and, after investigating the attack, determined on August 28 that the
attacker gained access to patients' personal information.

"On August 9, 2020, Luxottica learned of the incident, contained it,
and immediately began an investigation to determine the extent of the
incident. On August 28, 2020, we preliminarily concluded that the
attacker may have accessed and acquired patient information," the
Luxottica data breach notification states.

The exposed information includes personal data (PII) and protected
health information (PHI), including medical conditions and history.

"The personal information involved in this incident may have included:
full name, contact information, appointment date and time, health
insurance policy number, and doctor or appointment notes that may
indicate information related to eye care treatment, such as
prescriptions, health conditions or procedures," Luxottica warned.

For some patients, credit card numbers and social security numbers
were also exposed.

If a patient had their payment information and SSNs exposed, Luxottica
offers a free two-year identity monitoring service through Kroll.

Luxottica is not aware of any misuse of the accessed data but advises
all patients to watch out for notices from their health insurers or
health care providers and monitor their credit statements and history
for fraudulent activity.

"We recommend that all potentially impacted individuals take steps to
protect themselves, for example by closely monitoring notices from
your health insurer and health care providers for unexpected activity.
If your payment card information and/or Social Security number were
involved in this incident, this is explicitly stated in your letter,"
Luxottica advised on a web site created specifically for this data
breach.

On October 27th, Luxottica has begun to mail notices to those who are
affected. They have also started releasing press releases on websites
for local newspapers to alert patients of the data breach.

This data breach comes on the heels of a recent Nefilim ransomware
attack on Luxottica that occurred on September 18th, 2020, and caused
significant outages, interruptions, and theft of unencrypted files.