Century Vision 2025 Data Breach
Company · Optical products and services · Vision care provider · Global
Century Vision Eye Care Provider Breach (2025): 42K Patient Records Including SSN Exposed
Eye care and vision services provider.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
67/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
ElevatedExposed data raises the risk of fraud, targeting, and impersonation. Proactive steps are warranted.
42KRecords
2025Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
SSNSocial Security Number
AddressPhysical address
Breach Summary
A ransomware attack attributed to the Abyss group surfaced on February 2, 2025 affecting Century Vision Global, a U.S.-based eye-care acquisition and management services organization, along with three affiliated clinic websites: independenceeye.com, kocheye.com, and prairieeyecenter.com. Century Vision Global serves as the parent management services provider for these clinics, which means a single compromise at the central support layer cascades into every affiliated practice.\n\nThe exposed data covered approximately 41,800 records, including names, email addresses, phone numbers, home addresses, and Social Security numbers. Because the affected entities are healthcare providers, additional protected health information including treatment, diagnostic, and insurance records may also have been compromised, although the published field set focuses on identity and contact data. No payment-card or banking exposure has been publicly reported.\n\nFor affected patients, the practical risk is identity theft and medical-identity fraud. The combination of name, home address, and Social Security number is a strong base for fraudulent credit applications, tax-return fraud, and insurance abuse. Anyone notified by Century Vision Global, Independence Eye, Koch Eye Associates, or Prairie Eye Center should treat their Social Security number as exposed, freeze credit at all three U.S. bureaus, and remain alert to suspicious medical billing or insurance correspondence. People should also be cautious of any unsolicited contact referencing past eye-care appointments or treatment, since attackers can use such pretexts to extract additional information.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
42K records analyzed
About Century Vision
Century Vision Global is a U.S.-based vision care acquisition and clinical support company. The privately held firm focuses on acquiring eye-care practices and providing centralized non-clinical services such as IT, billing, and operations support to the clinics in its network. As of recent reporting it employs around 400 people and reports approximately $92 million in annual revenue. Affiliated practices in the Century Vision Global network include independenceeye.com, kocheye.com, and prairieeyecenter.com, with operations spanning multiple U.S. states.
Why They Hold Your Data
Vision-care providers collect customer or patient identity, contact, prescription, appointment, billing, and service records tied to optical products and eye-care services.
Recent Developments
The breach surfaced when the Abyss ransomware group listed Century Vision Global and three affiliated eye-care websites on its dark-web leak page on February 2, 2025. Century Vision Global has not issued a detailed public statement about the incident and has not appeared on the U.S. Department of Health and Human Services public breach portal under that exact name as of early 2026. One affiliated practice, Koch Eye Associates of Rhode Island, was named separately in mid-2025 in connection with another Abyss-linked exfiltration claim of approximately 313 GB of data, suggesting either a delayed disclosure of the same incident or a follow-on attack.
Data Points Exposed
4 verified field types
Email Address
Phone Number
Physical address High
Social Security Number Critical
Breach Impact
Direct institutional cost to Century Vision Global has been moderated by the company's lower public profile, but the impact extends across the affiliated clinics that share its centralized systems. As a healthcare-acquisition company supporting affiliated practices, a compromise at the central support layer creates simultaneous regulatory exposure for each affected clinic under the U.S. Health Insurance Portability and Accountability Act, including potential breach-notification, fine, and resolution-agreement obligations through the Department of Health and Human Services Office for Civil Rights. The incident also weakens the consolidation pitch the company makes to acquired practices, since shared services include shared cyber risk.
Exploitation & Downstream Threats
• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A healthcare-linked breach: exposure ties a named individual to a provider relationship and, where clinical or insurance data is present, to conditions and treatment. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
AL
Threat Actor: Abyss LockerConfidence: High
Motivation: Financial extortion
A ransomware and data extortion operation observed since 2023. Public reporting links its Linux and ESXi capabilities to Babuk-derived code.
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation