A ransomware group called Dark Project has reportedly listed Beach Eye Medical Group, an eye care practice, as a victim on its leak site. The practice has not publicly confirmed an incident, and what data may be involved is unconfirmed.
Beach Eye Medical Group’s Data Breach Investigation
Beach Eye Medical Group is an eye care practice whose physicians treat conditions such as cataracts and glaucoma with medical, laser and surgical care. A practice of that kind keeps clinical records, appointment and insurance details, and employment files. An incident at a medical group can therefore touch several different groups of people, including patients, former patients and staff.
On October 20, 2026, ransomware tracking services recorded that a group calling itself Dark Project had added Beach Eye Medical Group to its dark web leak site. One tracker lists an estimated attack date of October 15, 2026. The group’s posting is reported to say that it took a large volume of files, described as covering the organization’s employees and patients, medical records, doctors’ reports and other internal company information. A plaintiff-side law firm has since published an investigation notice, noting that the allegations have not been independently verified and that the specific types of information involved have not been publicly confirmed. This page treats all of these items as claims and investigations, not as established facts.
Beach Eye Medical Group has not publicly confirmed that its systems were breached. None of the sources reviewed included a notice letter, a regulatory filing or a statement from the practice describing an incident. They also do not say how an intruder would have gotten in, which systems were involved, whether any information was actually copied, or whether patient care was disrupted. The leak-site description is the attacker’s own wording, and attackers have every reason to make a listing sound as damaging as possible.
No count of affected people has been published. This page therefore does not estimate how many patients or employees may be involved, and it does not list specific data types as exposed. Some tracking sites attach generic data categories to every leak-site entry automatically, and those labels are not evidence of what was actually taken.
A leak-site listing and a legal notification duty are different things. Extortion groups post victims to pressure them into paying, and a listing alone does not prove that a breach occurred. For healthcare providers, federal rules generally require notice to affected patients after the provider determines that protected health information was compromised, and that determination can take weeks or months. An attacker’s public claim often appears long before any official notice, and some claims later turn out to be exaggerated while others are confirmed.
If the claim proves accurate, the kind of records a medical practice keeps is a real concern. Patient files can include a name, address, date of birth, Social Security number, insurance member numbers, diagnoses, treatment notes and billing details. Information of that kind can enable medical identity theft, insurance fraud, and convincing phishing messages that mention a real provider or a real procedure. Employee files can add tax forms and direct deposit details. That is general context about medical practices, not a statement about what Beach Eye Medical Group held or what was taken.
At this stage nobody needs to take drastic steps, but a few precautions cost little. Watch your mail for any notice from the practice. Be cautious with unexpected calls, texts or emails about your appointments, insurance or billing, and confirm any request by phone using a number you already trust. Review the explanation of benefits statements your insurer sends, because they can reveal care you did not receive. Consider checking your credit reports and asking the credit bureaus how to place a freeze. If a notice does arrive, it will be the best source for what happened to your information.
This page will be reviewed if Beach Eye Medical Group, a regulator or a reliable news outlet publishes more detail. A claim by an extortion group is not a finding about fault, and whether a practice’s safeguards were adequate remains an open question. Those are the kinds of questions attorneys can ask on behalf of people who were harmed if the claim is confirmed.
When Did This Breach Occur?
The leak-site listing was first recorded by tracking services on October 20, 2026, and one tracker gives an estimated attack date of October 15, 2026. Beach Eye Medical Group has not announced a timeline, and the sources reviewed do not say when any intrusion may have taken place. The date of a listing is not necessarily the date of an incident.
If you receive a notice, its own dates and description will be the most reliable record of the timeline for your information.
What Information Was Breached?
No specific data types have been confirmed. The ransomware group’s listing is reported to refer to patient and employee files, medical records and doctors’ reports, and an attorney notice says the specific information involved has not been publicly confirmed.
Because nothing has been confirmed, it is prudent to watch for a notice that will state which details, if any, were involved.
What You Can Do
If you received a notice related to Beach Eye Medical Group or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Review explanation of benefits statements, bank, card and insurance statements for anything you do not recognize.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Be skeptical of unexpected calls, texts or emails about your care, insurance or billing, and verify any request by phone using a number you already trust.
- Report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Beach Eye Medical Group
If you are notified that your personal or health information was exposed in an incident involving Beach Eye Medical Group, you may have legal options. Healthcare providers are expected to safeguard the sensitive information patients entrust to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
