Eyemart Express, a national optical retailer, disclosed on Friday that a cybersecurity incident compromised customer data—including Social Security numbers, prescription details, and vision insurance information. The breach occurred on February 12, 2026, but notifications are only now reaching consumers, leaving a trail of unanswered questions and significant identity-theft risks.

The Breach: What We Know So Far

On July 24, 2026, Eyemart Express issued a statement confirming that unauthorized access to its systems had occurred on February 12, 2026, and was discovered the following day. The company says it contained the incident, secured its systems, and launched an investigation. But many details remain undisclosed.

The data involved varies by individual but may include:

  • Full names
  • Mailing addresses
  • Dates of birth
  • Social Security numbers
  • Vision insurance information
  • Eyeglass purchase records
  • Prescription information

Eyemart Express has not publicly stated how many people were affected, how the attacker got in, or whether any data was actually exfiltrated or merely viewed. Customers are being notified by mail where addresses are available, and those whose Social Security numbers were involved are being offered credit monitoring. The company says it is cooperating with law enforcement and reviewing its security practices.

Why This Data Is So Dangerous

At first glance, a breach involving eyewear might seem less alarming than one that exposes credit card numbers. But the combination of data here is a goldmine for identity thieves.

Social Security numbers are the prize. Unlike a bank password, you can’t simply change your SSN. Once it’s in the wrong hands, it can be used to file fraudulent tax returns, open new credit accounts, take over existing ones, apply for government benefits, or even build synthetic identities—where criminals blend real and fake information to create new personas.

Prescription and insurance details supercharge scams. They may not look like immediate financial threats, but they give scammers rich context. A criminal who knows you recently bought glasses, uses a specific vision plan, or has a pending prescription can craft incredibly believable phishing emails, texts, or phone calls. They might pose as your optometrist, insurance provider, or Eyemart Express itself, claiming:

  • Your prescription needs urgent confirmation
  • A refund is waiting due to a billing error
  • You need to verify your identity after a “security update”
  • A replacement pair of glasses is ready for pickup

Purchase history adds another layer. Armed with approximate dates and product types, an attacker can convincingly impersonate customer support and coax you into revealing credit card numbers, one-time passcodes, or insurance member IDs. Windows users, in particular, should be wary of links that lead to fake login pages designed to harvest Microsoft, Google, or Apple ID credentials—which then become the keys to a far wider digital life.

How We Got Here: A Timeline

  • February 12, 2026: Unauthorized access occurs.
  • February 13, 2026: Eyemart learns of the activity and initiates containment.
  • February–July 2026: Investigation period. The company works to determine scope, identify affected individuals, and coordinate with law enforcement.
  • July 24, 2026: Public notification is released, and mail notices begin reaching customers.

That five-month gap between breach and public notice is not unusual for complex investigations, but it means that if the data was exfiltrated, it may have been circulating on criminal forums for months. By the time a consumer receives a letter, the window for early detection may already have closed.

What to Do Now

If you receive a letter from Eyemart Express—or if you’ve ever done business with them and worry you may be affected—act quickly. Here’s your practical checklist:

1. Verify the notification is real

Legitimate breach notices don’t ask for passwords or payment. If you’re unsure, call Eyemart Express directly at 800-655-4635 (the number listed in their statement). Never trust a link or phone number provided in an unsolicited email that claims to be about this breach.

2. Freeze your credit reports—immediately

A security freeze restricts access to your credit file, making it far harder for anyone to open new accounts in your name. It’s free, doesn’t affect your credit score, and can be temporarily lifted when you legitimately need credit. Place a freeze with all three major bureaus:

Alternatively, you can call each bureau. A fraud alert is another option, but a freeze provides stronger protection against new-account fraud.

3. Review your credit reports

You’re entitled to free weekly reports from AnnualCreditReport.com. Look for:

  • Accounts you didn’t open
  • Inquiries from lenders you don’t recognize
  • Addresses or employers you’ve never had
  • Unexplained changes to your personal information

If you spot anything suspicious, contact the credit reporting agency directly using a verified number—never one from a suspicious email.

4. Strengthen your email and online accounts

Your email is the master key to other accounts. Use a unique, strong password and enable multifactor authentication (MFA)—preferably via an authenticator app or security key, not just SMS. If you receive an unexpected password-reset email, assume it’s a phishing attempt until proven otherwise.

5. Treat optical, insurance, and health messages with suspicion

For the coming months, be hypervigilant about calls, texts, or emails that reference glasses, prescriptions, vision insurance, Eyemart Express, or data-breach compensation. Do not:

  • Click links in such messages
  • Call numbers they provide
  • Share one-time codes or passwords
  • Install remote-access software (a favorite scammer tool)

Instead, manually navigate to the official website or use a trusted app to check your accounts.

6. Monitor all financial accounts, not just credit reports

Enroll in the credit monitoring service offered by Eyemart Express if you receive it—it can alert you to certain credit-file changes. But don’t rely on it alone. Also watch your bank, credit card, insurance, and mobile accounts for:

  • Unrecognized transactions
  • New payees or shipping addresses
  • Profile changes you didn’t make
  • Login attempts from unfamiliar locations

Enable transaction alerts wherever possible.

7. Keep records of anything suspicious

If you see a scam attempt, save the message, take screenshots, and note the date and time. If you fall victim, file a report with the Federal Trade Commission at IdentityTheft.gov and your local police. Good documentation helps you dispute fraudulent charges and may assist in any future legal settlements.

The Limits of Credit Monitoring

Credit monitoring is a helpful detection tool, but it’s not a silver bullet. It typically alerts you after a credit inquiry or new account appears—it doesn’t prevent most forms of identity theft. Criminals can still use your SSN for tax fraud, medical identity theft, or to take over existing accounts that don’t trigger credit checks.

A credit freeze is the closest thing to a prevention switch. Combine it with monitoring, strong account security, and a healthy skepticism of breach-related communications.

What to Watch Next

Eyemart Express says it is reviewing and updating its processes to reduce the risk of a repeat incident. As the investigation unfolds, more details may emerge—how many records were affected, the attack vector, and whether stolen data has appeared on dark web marketplaces. For now, assume the exposed information could be misused for years.

The breach is a stark reminder that the most damaging data isn’t always a credit card number. A name, date of birth, SSN, and purchasing habits together can open doors that stay open for a very long time.

This story will be updated as new information becomes available.