Concord Eye Center Data Breach: Attack Claimed, No Lawsuit Filed
Reference Guide
Concord Eye Center, an eye practice in New Hampshire, says it found a cybersecurity incident on part of its network and is investigating. On October 12, 2026 a ransomware group claimed the attack and said it took patient records. As of October 17, 2026 there is no Concord Eye Center data breach lawsuit we could find, no official count of affected patients, no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened, and What Is Only Claimed
Two different kinds of information exist, and they should not be mixed up.
What the practice says. According to a notice on its website, as quoted by ClassAction.org, Concord Eye Center “recently discovered a cybersecurity incident impacting a portion of its network environment” and began an investigation with forensic experts. The practice said the review may take several weeks and that “data impact is possible.” We could not open the practice’s website ourselves, so we have not seen the notice directly.
What the attackers claim. On October 12, 2026 the ransomware group Interlock listed Concord Eye Center on its leak site, per the tracking site Ransomware.live. The group claims it took names, addresses, dates of birth, Social Security numbers, medical histories, diagnostic and lab results, surgical records, and insurance and payment records. The tracker Breachsense lists the claimed leak at 290 GB. These are the attackers’ claims. The practice has not published what was actually taken.
Case details
No lawsuit found. As of October 17, 2026, we found no Concord Eye Center data breach lawsuit in any court. Our database of new federal filings (all district courts, from October 10, 2026) shows no case naming the practice. We could not run a full search of New Hampshire state court records, so a very recent state filing cannot be ruled out.
What does exist are law-firm investigations. ClassAction.org published one on October 13, 2026. It says attorneys are “looking into whether a class action lawsuit can be filed.” An investigation is a search for clients, not a case.
The practice’s legal name is Concord Ophthalmologic Associates, P.A., doing business as Concord Eye Center. That name would appear on any future complaint.
Status: Claimed Attack, No Case, No Settlement
We found no report to the HHS breach portal or the New Hampshire attorney general giving a number of affected patients. ClassAction.org also lists the impacted data as “TBD.”
The next real step is a notice letter from the practice. Federal health privacy rules require a provider to notify patients by mail once it confirms their data was exposed. Lawsuits over breaches like this are usually filed after those letters go out.
Could You Be Affected?
If you have been a patient of Concord Eye Center, your records could be in the data the attackers claim to hold. Nobody can tell you yet whether they are.
The practical test is your mail. If the practice confirms patient data was taken, it must send letters saying which details were involved. Keep that letter and its envelope. It is your proof if a class action is later filed or settled.
You do not need to sign up anywhere to be included in a future class. If a class is certified or a settlement is reached, a court-appointed administrator contacts class members directly.
Is There Any Money?
For a sense of what nearby cases paid, not a prediction: Concord Orthopaedics, a different Concord practice, settled a breach case over a November 2024 attack on 72,815 people. Class members could claim documented losses up to $3,000 or a cash payment estimated at $50. That claim deadline was July 8, 2026. Our data breach settlement calculator shows how comparable payouts work.
Concord Eye Center Breach Timeline
By October 13, 2026 — Practice Posts an Incident Notice
Concord Eye Center says it found a cybersecurity incident on part of its network and brought in forensic experts. It says data impact is possible.
October 12, 2026 — Ransomware Group Claims the Attack
Interlock lists the practice on its leak site and claims it took patient identity, medical and billing records. These are the attackers’ claims.
October 13, 2026 — Trackers Record a 290 GB Claim
Breachsense logs the listing with a claimed leak size of 290 GB. No independent check of the data has been published.
October 13, 2026 — Law Firms Open Investigations
ClassAction.org posts an investigation page. Attorneys say they are looking into whether a class action can be filed. No complaint is filed.
October 17, 2026 — No Count, No Lawsuit
We find no official count of affected patients, no lawsuit, no settlement and no claim form.
Three Things to Watch For
A claimed leak of patient records with no official notice yet is the gap scammers use:
Calls or emails using your eye exam details
If the attackers’ claims are true, criminals may have real visit and insurance details. A caller who knows your appointment or your insurer is not proof they are from the practice. Hang up and call Concord Eye Center on the number you already have.
“Claim your Concord Eye Center settlement”
There is no settlement and no claim form. A site asking for your Social Security number to “register for compensation” is collecting data, not filing anything.
Mixing it up with other Concord cases
Concord Hospital and Concord Orthopaedics have real settlements, but they are different cases. A message that uses those settlements to push you toward a “Concord Eye” payout is wrong.
Concord Eye Center Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a Concord Eye Center data breach lawsuit?
Not that we could find as of October 17, 2026. Law firms have announced investigations, which means they are looking for affected patients. No complaint naming Concord Ophthalmologic Associates, P.A. has turned up in our search of new federal filings.
What data was taken in the Concord Eye Center data breach?
That is not confirmed. The practice says data impact is possible. The ransomware group Interlock claims it took names, addresses, dates of birth, Social Security numbers, medical and surgical records, lab results, and insurance and payment records. Those are the attackers’ claims.
How many patients were affected?
No number has been published. We found no report to the HHS breach portal or the New Hampshire attorney general as of October 17, 2026. The only figure out there is the attackers’ claim of 290 GB of data, which is not a patient count.
How can I check if my name has been involved in a data breach?
For this incident, the reliable answer is a notice letter from Concord Eye Center. A provider that confirms patient data was exposed must tell those patients by mail. Leak-site listings and online “check your name” tools cannot confirm whether your own eye-care records were in this data.
How can I file a data breach claim?
For Concord Eye Center, you can’t yet, because there is no settlement. If one is reached, the court-appointed administrator mails notices with the claim steps and deadline. Our list of open settlements shows cases that are taking claims now.
What are the current data breach settlements available?
None for Concord Eye Center. Two other Concord, New Hampshire cases did settle, and their claim deadlines have passed: Concord Orthopaedics (July 8, 2026) and the Concord Hospital website-tracking case (September 11, 2026). Concord Hospital’s final approval hearing is set for November 3, 2026. For other eye-practice breaches, see Eye Physicians of Central Florida and the Asheville Eye case.
Is this related to Concord Eye Center’s earlier settlement with HHS?
No. On April 20, 2022 the HHS Office of Inspector General announced that the practice agreed to pay $103,786.40 over billing for services by doctors not credentialed with federal health programs. The practice self-disclosed that issue. It is a billing matter, has nothing to do with this cyberattack, and pays nothing to patients.
What should I do right now?
Freeze your credit at all three bureaus — free and reversible. Read your insurer’s explanation-of-benefits statements for care you never received. Watch your mail for a letter from Concord Eye Center and keep it. Do not give personal details to callers who say they represent the practice or a settlement.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Skin Center Data BreachAnother clinic named by attackers in October 2026, no lawsuit found
- Hattiesburg Eye Clinic Data BreachEye practice breach with notices sent, no lawsuit found
- Northern NJ Eye Institute BreachEye practice incident, no confirmed notice and no lawsuit
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person