Eyemart Express Data Breach Lawsuit: What Happened and Where the Case Stands
Active Litigation
Someone got into Eyemart Express’s systems on February 12, 2026. The company sent letters about it in July. Several class actions followed in federal court in Dallas, and they are now being handled together by one judge. As of October 17, 2026, there is no settlement, no fund and no claim form for the Eyemart Express data breach. Here is what the letters say, what the Eyemart Express data breach lawsuit claims, and how to tell a real notice from a fake one.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Eyemart Says Happened
Eyemart Express is an optical retailer based in Farmers Branch, Texas, with more than 250 stores in 42 states. Its own notice letters, filed with the California Attorney General, say the company learned on February 13, 2026 that someone had accessed its systems on February 12, 2026. Eyemart says it contained the incident and secured its systems the same day. It also says it could not identify the affected files with reasonable certainty until on or about March 17, 2026. Letters went out in July.
What was exposed depends on how you dealt with Eyemart. The customer notice describes names, addresses, dates of birth, Social Security numbers, health plan details, vision insurance information, and eyeglass purchase or prescription records. A separate letter to employees describes files tied to their employment, including payroll information. In its filing with Washington State, Eyemart also checked boxes for driver’s license numbers, financial and banking information, passport numbers and medical information.
Eyemart says it is cooperating with federal law enforcement. According to ClaimDepot, a breach tracker, a ransomware group posted on March 10, 2026 that it had taken 435 gigabytes of Eyemart data. That figure is the attackers’ claim, and Eyemart has not confirmed it. The lawsuits allege that Eyemart did not protect this data well enough. Eyemart has not admitted that.
Case details
Six suits against Eyemart Express LLC were filed in the U.S. District Court for the Northern District of Texas (Dallas) between April 29 and May 11, 2026:
• Bond v. Eyemart Express LLC, No. 3:26-cv-01378, filed April 29, 2026. It is still open.
• Lewis v. Eyemart Express LLC, No. 3:26-cv-01402, a class action filed April 30, 2026.
• Dantonio v. Eyemart Express LLC, No. 3:26-cv-01400, filed April 30, 2026.
• Iwanicki v. Eyemart Express LLC, No. 3:26-cv-01420, filed May 1, 2026.
• Estrada v. Eyemart Express LLC, No. 3:26-cv-01513, filed May 11, 2026.
• Montgomery v. Eyemart Express, LLC, No. 3:26-cv-01514, filed May 11, 2026. We could not confirm from the docket that this one is about the breach.
All of them are before Judge Ed Kinkeade. On June 26, 2026, the judge paused Eyemart’s deadline to respond until the court rules on the plaintiffs’ unopposed motion to consolidate the related class actions, appoint interim class counsel and set a schedule. The Lewis, Dantonio, Iwanicki and Estrada dockets were all closed on August 25, 2026, while Bond stayed open. That pattern suggests the cases were combined into Bond, but we have not been able to read the order itself.
Status: One Combined Case in Dallas, No Settlement
There is no settlement, no fund, no administrator, no claim form and no deadline to file anything. No court has ruled on whether Eyemart was at fault. Any website or message offering an “Eyemart settlement payment” is describing something that does not exist yet.
Some attorney advertising sites are also signing people up for mass arbitration. That is a different route from the class action: each person brings an individual claim. See lawsuit vs. arbitration before you sign anything.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Could Be Part of the Case
If a class is certified or a settlement is reached, it would cover people whose information was involved in the February 2026 incident. That could include customers, patients of Eyemart’s optometry services and employees. There is nothing to join or register for now.
The practical test is your mail. Eyemart filed sample letters dated July 15, 2026 (employees) and July 24, 2026 (customers). They come from P.O. Box 989728, West Sacramento, CA, and give the help line 1-866-200-0991. Eyemart also gave news outlets a company number, (800) 655-4635, that you can call to check whether you were affected. Keep your letter, because it lists which of your details were involved.
What a Case Like This Could Pay
What exists now is what Eyemart offered in its letters. The employee letter offers 12 or 24 months of IDX credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and identity-recovery help, with an enrollment deadline of October 15, 2026. Check your own letter for your offer and your deadline. For customers whose Social Security numbers were involved, Eyemart says the credit monitoring is free.
For context, not as a prediction: settled breach cases usually repay documented losses, sometimes add a small flat payment, and may include monitoring. One resolved example on this site is the Panda Express data breach settlement ($2.45M).
Eyemart Express Breach Timeline
February 12–13, 2026 — The Intrusion
Someone gets into Eyemart’s systems on February 12. Eyemart says it learned of it the next day and contained it the same day.
March 2026 — Claim and File Review
A ransomware group claims on March 10 that it took data. Eyemart says it identified the affected files on or about March 17.
April 29 – May 11, 2026 — Suits Filed in Dallas
Bond, Lewis, Dantonio, Iwanicki and Estrada are filed in the Northern District of Texas. All go to Judge Ed Kinkeade.
June 26, 2026 — Consolidation Requested
The judge pauses Eyemart’s deadline to respond while the plaintiffs’ unopposed motion to consolidate the cases is pending.
July 15 and 24, 2026 — Letters Go Out
Eyemart mails notices to employees and customers. Washington’s attorney general logs the report on July 24 with 1,704 state residents.
August 25 – October 16, 2026 — One Case
Four of the dockets close on August 25. An amended complaint is filed in Bond on October 16. There is still no settlement.
Three Things to Watch For
A breach that exposed Social Security numbers and insurance details, with no claim form yet, is an easy opening for imposters:
“Claim your Eyemart settlement” pages
There is no Eyemart claims site, because there is no settlement. A page that asks for your Social Security number or vision-insurance ID to “secure your payment” is collecting data, not filing a claim.
Fake “IDX enrollment” calls and texts
The real letters send you to IDX yourself, using the enrollment code printed on the letter. A call or text that offers to “re-activate” your monitoring, asks for a card number, or gives a different phone number is not from Eyemart.
Sign-up forms dressed up as the lawsuit
Ad-driven forms that recruit people for mass arbitration or for a law firm are not the court case. Nobody needs to sign anything to be included in a class action. Read any retainer before you sign it.
Eyemart Express Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there an Eyemart Express data breach settlement or claim form?
No. As of October 17, 2026, the federal case in Dallas is at an early stage. There is no settlement, no fund, no administrator, no claim form and no deadline. If that changes, class members are told directly through a notice approved by the court.
What is the latest Eyemart Express data breach lawsuit update?
On October 16, 2026, an amended complaint was filed in Bond v. Eyemart Express LLC, No. 3:26-cv-01378, in the Northern District of Texas. On June 26, 2026, the judge paused Eyemart’s deadline to respond until the court ruled on the consolidation motion. We have not read that ruling. Four related dockets were closed on August 25, 2026.
Is the Eyemart breach letter real?
The sample letters Eyemart filed with California are dated July 15 and July 24, 2026. They come from P.O. Box 989728 in West Sacramento, CA, and give 1-866-200-0991 as the help line. Eyemart also gave news outlets the number (800) 655-4635. If you are unsure, call one of those numbers yourself rather than any number in a text or email.
What information was exposed?
It depends on your relationship with Eyemart. Customer notices describe names, addresses, dates of birth, Social Security numbers, health plan and vision insurance information, and purchase or prescription records. Employee letters describe employment and payroll information. Your own letter lists your details.
How many people were affected?
There is no official nationwide total in the notices we have read. Washington’s attorney general lists 1,704 Washington residents. ClaimDepot, a breach tracker, reports 45,460 Texas residents and a total of 189,432 people in Indiana’s attorney general listing. We could not open those filings ourselves.
Do I have to do anything to be included?
No. If a class is certified or a settlement is approved, you are included unless you opt out by the deadline in the official notice. Signing up on an advertising site is not the same as joining the court case.
Is this the same as the Eyemart Meta pixel lawsuit?
No. Rand v. Eyemart Express LLC, No. 3:24-cv-00621, was filed in 2024. It alleged that tracking code on Eyemart’s website shared health information with Meta. The district court dismissed it on May 27, 2025, and the plaintiffs appealed to the Fifth Circuit (No. 25-10784). That case has nothing to do with the 2026 breach and offers no breach compensation.
What should I do right now?
If your letter includes a monitoring code, enroll before the deadline printed on it. The employee letter’s deadline was October 15, 2026. Freeze your credit at all three bureaus, which is free and reversible. Watch your vision and health insurance statements for claims you never made, and keep your notice letter.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorEstimate what breach settlements typically pay per person
- Open Class Action SettlementsSettlements you can still file a claim in, with deadlines
- Lawsuit vs. ArbitrationHow mass arbitration differs from joining a class action
- Class Action Payout CalculatorHow settlement funds are split among claimants