Tri-Century Eye Care (PA) Ophthalmology Breach (2025): 200K Patient Records Including SSN, Medical & Financial Data Exposed via PEAR

About Tri-Century Eye Care

Tri-Century Eye Care is an ophthalmology and vision-care practice with several locations in Bucks County, Pennsylvania, providing eye exams, medical eye care, and surgical/ophthalmic services. It maintains patient identity, insurance, billing, and clinical records.

Why They Hold Your Data

Eye-care providers collect patient identity, contact, insurance, billing, appointment, and treatment records tied to vision care and clinical services.

Recent Developments

Tri-Century Eye Care detected a breach on September 3, 2025 and, on September 19, 2025, confirmed that patient and employee PII/PHI were compromised. The PEAR ransomware group claimed the attack (announced September 18, 2025), asserting theft of over 3 TB of data. About 200,000 individuals were affected per HHS; class-action investigations followed.

Data Points Exposed

Breach Impact

The exposure combined identity, financial, and clinical data (SSNs, dates of birth, medical/treatment and insurance information, and billing/tax/financial data) for roughly 200,000 patients and employees, an unusually complete bundle for an eye-care practice that enables identity theft, payment fraud, and medical fraud, plus credible treatment- and billing-themed scams.

Exploitation & Downstream Threats

• Full identity theft and synthetic identity construction using SSN and DOB | • Payment and tax fraud using exposed billing/financial/tax data | • Medical identity fraud and insurance abuse using diagnosis and insurance data | • Targeted phishing and vishing referencing eye care or billing | • Doxxing and physical targeting from exposed home addresses

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
4. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
5. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).