Kannarr Eye Care has told patients that an unauthorized actor accessed files containing personal and health information relating to some of them.
Here is what the practice has disclosed so far and what you can do if you were a patient.
Kannarr Eye Care’s Data Breach Investigation
Kannarr Eye Care (KEC) is an optometry practice based in Pittsburg, Kansas, with offices in Pittsburg, Girard and Fort Scott. It provides eye exams, contact lenses, glasses and the treatment of eye disease. The practice posted a Notice of Data Incident on its website describing what it found and what patients can do.
According to that notice, KEC identified unauthorized access to certain systems within its network on March 30, 2026. It says it moved to secure and contain the incident and began an investigation with independent cybersecurity and forensic specialists. The investigation determined that an unauthorized actor accessed certain files containing personal and health information relating to some patients.
After the investigation, the practice carried out a detailed review of the affected files to determine whose information may have been involved and to find current contact details for those people. KEC says that review was completed on August 17, 2026, and that on September 17, 2026 it mailed notification letters to affected individuals for whom a valid mailing address was available.
The practice states that it has no evidence that any information has been misused at this time. It also says it enhanced its security measures, put additional technical safeguards in place, strengthened its cybersecurity policies and procedures, and worked with independent cybersecurity professionals to reinforce its security posture. Those are the practice’s own statements, and this page repeats them as such.
The notice does not give the number of people affected, and this page does not estimate one. It also does not describe how the actor got in or whether a ransom demand was made. Readers should treat any figure or cause that appears elsewhere, without a source tied to the practice itself, with caution.
The timeline is worth reading closely. The practice identified the access on March 30, 2026, finished its file review on August 17, 2026, and mailed letters on September 17, 2026. That is roughly five and a half months between discovery and the date the review finished, and almost six and a half months before letters went out. For patients, it means information may have been exposed for a long stretch before anyone told them.
The notice also serves as a substitute notice for people whom the practice could not reach directly because it had no valid mailing address for them. If you were a patient who has moved, or whose contact details changed, you may not have received a letter even though your information was in the files. The notice lists a dedicated assistance line for people who believe they may be affected but did not receive one.
Eye care records can include more than vision prescriptions. They may be tied to insurance details, medical history and identity numbers, and the combination of a Social Security number with medical and insurance information is useful to someone trying to commit medical identity theft or open accounts in another person’s name. That is why the standard protective steps listed below are worth taking, even if the practice says it has no evidence of misuse.
Healthcare breaches of this kind are common because medical practices hold valuable records and often run lean technology teams. Regulators expect covered healthcare providers to notify patients without unreasonable delay, and the long review period described above is a reasonable question for patients to raise when they call the practice’s assistance line.
If you received a letter, keep it with its envelope, note the date it arrived and read it for the specific information that applies to you, since the practice says not all information was affected for every individual. If you are unsure whether a message about this incident is genuine, contact the practice using the phone number on its own website rather than a number given in an unexpected message.
When Did This Breach Occur?
The practice says it identified unauthorized access on March 30, 2026. It completed a review of the affected files on August 17, 2026.
Notification letters were mailed on September 17, 2026 to affected individuals with a valid mailing address available.
What Information Was Breached?
According to the practice, the information involved may have included names, Social Security numbers, medical information and health insurance information.
The practice says not all information was affected for every individual. Your notice letter should describe the information that applies to you.
What You Can Do
If you received a notice related to Kannarr Eye Care or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If you believe you were affected but did not get a letter, call the dedicated assistance line listed in the practice’s notice.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Kannarr Eye Care
If your personal information was exposed in this incident, you may have legal options. Organizations are expected to protect the sensitive information they are trusted with, and a class action can help hold them accountable when security falls short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
