Two attacks on small eye care practices, disclosed days apart, show clinic administrators a familiar pattern: the extortion crew announces first, the practice confirms months later.
Hattiesburg Eye Clinic, an ophthalmology and surgical practice in south Mississippi, reported a network disruption on August 18 that exposed information for 6,137 patients. The review concluded September 16 and the filing with the HHS Office for Civil Rights landed October 5. Names, phone numbers, Social Security numbers and diagnoses were potentially involved. The Gentlemen ransomware crew had already named the clinic on its leak site in mid-September.
Three thousand more in Washington state
Eye Care Center of Snohomish, operating as Anup K. Deol, OD PS, found an intruder inside portions of its network holding information for 3,059 patients. Unauthorized access was identified August 12, with entry around July 28. The review closed September 28, and exposed data may include addresses, birth dates, lab results, diagnoses and medications. The same crew listed the Washington practice in late August.
Neither organization confirmed a data theft at the time of the listing, and neither has said whether a ransom was paid.
Why eye clinics keep appearing
Small specialty practices hold detailed clinical histories and insurance identifiers while running one IT contractor and a shared-login habit. For an extortion crew, a 3,000-record practice is cheap to breach and just visible enough to pressure. When a listing names an organization weeks before any notice reaches patients, the practice has usually spent that time on forensics rather than communication, leaving patients to learn the news from a leak site.
The defensible response is to assume a listing may be accurate. Pre-draft patient notice language, verify what the crew actually holds, and count the notification deadline from the moment data was accessed rather than the day the investigation ends.
