Reported to the IN Attorney General on July 15, 2026.
IN residents may qualify for compensation. Free attorney review — no obligation, no upfront cost.
Check My Rights →Eyemart Express LLC was the subject of a data breach notification filed with the IN Attorney General. The AG filing was recorded on July 15, 2026. The breach or discovery date reported in the filing is February 13, 2026.
Eyemart Express LLC operates as a prominent nationwide optical retailer, providing fast prescription eyewear, eyeglasses, sunglasses, and comprehensive eye exams to millions of consumers through its extensive network of retail stores and online platforms. Because of its dual role as a retail provider and an entity handling vision care and medical prescription data, the company routinely collects and stores vast quantities of highly sensitive consumer and patient information. This includes not only standard retail transaction and contact details, but also precise medical prescription records, vision measurements, health insurance information, and government-issued identification details required to fulfill medical device orders and process insurance claims. In 2026, Eyemart Express LLC reported a significant data security incident to the Indiana Attorney General, triggering notification requirements under state law. While the precise mechanics of the breach are still being scrutinized, retail and consumer healthcare hybrids of this scale frequently face sophisticated cyber threats such as credential stuffing, third-party vendor compromises, or unauthorized intrusion into centralized customer relationship management (CRM) and e-commerce databases. These threat actors increasingly target retail networks to harvest valuable personal identifiable information (PII) and protected health information (PHI) that can be monetized on illicit dark web marketplaces or utilized in targeted financial fraud. The exposure resulting from the Eyemart Express LLC breach encompasses a dangerous amalgamation of retail and healthcare data, leaving affected individuals vulnerable to multiple vectors of exploitation. Compromised prescription and vision data, combined with full names, dates of birth, and contact information, creates severe risks for targeted medical identity theft and fraudulent health insurance claims. Furthermore, if financial and payment card data or Social Security numbers were accessed, victims face an immediate threat of unauthorized credit card charges, financial account takeover, and long-term risks associated with synthetic identity fraud, which can take years to detect and resolve. As a commercial entity holding consumer and patient records, Eyemart Express LLC is bound by rigorous legal obligations under state data protection statutes, the Federal Trade Commission Act, and applicable privacy regulations to maintain reasonable security safeguards. These legal standards require companies to implement robust administrative, technical, and physical safeguards—such as multi-factor authentication, regular vulnerability assessments, and robust data encryption—to prevent unauthorized access to sensitive databases. The occurrence of a data breach of this magnitude strongly suggests that the company may have failed to uphold its duty of care, potentially leaving vulnerabilities unpatched or failing to monitor network traffic effectively. Receiving a formal data breach notification letter from Eyemart Express LLC serves as a legal acknowledgment that your private information was compromised due to corporate negligence, establishing the necessary legal standing to participate in a class action lawsuit. Class members do not need to prove that they have already suffered direct financial loss or identity theft to seek legal recourse; the mere compromise of your data and the resulting necessity of constant credit monitoring constitutes a compensable injury. Our law firm is currently investigating potential claims against Eyemart Express LLC on a contingency fee basis, meaning you pay absolutely nothing out of pocket unless we successfully recover compensation on your behalf.
Based on the data types reported in this filing, affected individuals face the following specific risks:
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
Phone numbers exposed in breaches are used for SIM swapping attacks — hijacking your number to bypass two-factor authentication on financial accounts.
Under the Indiana data breach notification law, you may have a legal claim against Eyemart Express LLC if any of the following apply:
Applicable law: This breach was reported under the Indiana data breach notification law, which establishes your right to seek damages from Eyemart Express LLC.
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
HIPAA violations carry civil penalties between $100 and $50,000 per violation. Where a healthcare organization's negligence led to the exposure of protected health information, class members may recover statutory damages in addition to actual losses.
Data breach victims regularly report anxiety, loss of sleep, and ongoing fear of identity theft. These non-economic harms are cognizable injuries in data breach litigation, particularly in cases involving SSN or medical record exposure.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under Indiana data breach notification law and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
If Eyemart Express LLC is a covered healthcare entity or business associate under HIPAA, affected patients have additional rights — including the right to an HHS complaint. These HIPAA violations also strengthen civil damages claims. Consult an attorney to understand your full remedies.
State statutes of limitations for data breach claims typically run 2–4 years from the date of the breach or its discovery. Because this breach was recently disclosed, the window is open — but acting early preserves your options and strengthens the case.
Accepting free credit monitoring from Eyemart Express LLC does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by Eyemart Express LLC during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Most data breach class actions resolve within 18 to 36 months, though timelines vary by court and complexity. Your participation requires minimal effort — typically completing a claim form. Our office handles all litigation; you are notified when a settlement is reached.
Received a notification letter from Eyemart Express LLC?
Read our dedicated guide — what the letter means and exactly what to do.
If you were affected by the Eyemart Express LLC data breach, you may be entitled to compensation. Submit your information below for a free attorney review — no obligation, no upfront cost.
Source: State Attorney General filing, IN
View Official AG Filing →Eyemart Express LLC breach?
Free case review · No fee unless you win