New Century Ophthalmology, an eye care practice with offices in Raleigh and Oxford, North Carolina, has told patients that an outside party gained access to its systems and copied certain data. Medical practices hold exactly the kind of records that identity thieves value most, so patients should understand what the practice has disclosed so far.
New Century Ophthalmology’s Data Breach Investigation
According to the notice the practice posted on its website, New Century Ophthalmology became aware of unauthorized activity within certain systems of the practice on August 18, 2026. The practice says it responded right away to contain the activity. The steps it lists include changing passwords, cutting off the unauthorized access and strengthening the monitoring on each workstation in its offices.
The practice also brought in outside data security and privacy professionals to investigate. That investigation determined that the unauthorized activity included the copying of certain data from the practice’s systems. The notice says the investigation could not rule out that files containing patient information were among the data taken, although the practice states that it has no evidence the information has been further disclosed or misused for identity theft or fraud. The practice also says it notified federal law enforcement and worked alongside them.
The incident later appeared in the Vermont Attorney General’s public list of security breach notices. That listing, dated November 4, 2026, shows 1 Vermont resident affected and identifies Social Security numbers, government ID numbers and health records as the categories involved. Vermont’s list counts only residents of that state, so it does not reflect the total number of patients affected. New Century Ophthalmology has not published an overall total in the sources reviewed, and the full scope of the incident has not been made public.
When a breach involves copied data rather than a simple system outage, the concern is not limited to the moment of the intrusion. Information that has left an organization’s control can be held, shared or sold long after the original event. That is why regulators and consumer advocates urge people who receive a notice to treat it seriously even when the organization reports no known misuse.
Healthcare providers, including specialty practices, are frequent targets for this kind of activity. A single patient file can combine identifying details, insurance information and treatment history in one place. Fraudsters can use a combination like that to open accounts, file false insurance claims or craft convincing phishing messages that reference a real doctor’s office. The practice’s notice itself describes the categories as general ones that may be present in the affected environment and may not apply to every person, so each patient’s own letter is the best guide to what applies to them.
Patients of the practice’s Raleigh and Oxford locations, as well as former patients whose records may still have been stored in its systems, may be affected. Anyone who has received a letter from New Century Ophthalmology or who suspects their information was involved should keep the letter and note any unusual activity on their accounts or insurance statements.
When Did This Breach Occur?
New Century Ophthalmology says it became aware of the unauthorized activity on August 18, 2026. The notice does not state when the unauthorized access began or how long it lasted, and the practice has not said when it finished identifying which patients’ information was involved.
The incident was reported to the Vermont Attorney General on November 4, 2026. A notice posted on the practice’s own website describes the incident and the practice’s response, but it does not give a mailing date for individual letters.
What Information Was Breached?
The practice says the following types of information may have been impacted: name, address, date of birth, Social Security number, driver’s license number, medical information including diagnosis and medications, and health insurance information. The Vermont listing separately names Social Security numbers, government ID numbers and health records.
The practice cautions that this list describes general categories of information that may be present in the affected environment during the incident, and that some categories may not be relevant to each person. Medical and insurance details are especially sensitive because they cannot be changed the way a password can, and they can be misused for medical identity theft as well as ordinary financial fraud.
What You Can Do
The practice encourages patients to stay alert for identity theft and fraud by regularly reviewing account statements and monitoring credit reports. These steps can help protect you:
Order your free credit reports from Equifax, Experian and TransUnion at annualcreditreport.com, and review them for accounts you do not recognize. Consider placing a fraud alert or a free security freeze on your credit files. Read every explanation of benefits statement from your health insurer and follow up on any service you did not receive. Share your insurance card only with your providers, and be cautious of calls, texts or emails that claim to come from the practice and ask for personal details. If you believe you are a victim of identity theft, contact the Federal Trade Commission and your state attorney general.
File a Data Breach Lawsuit Against New Century Ophthalmology
Patients trust a medical practice to protect their Social Security numbers, medical histories and insurance details. When that information is copied from a practice’s systems, affected patients may have legal options, including joining a class action to seek compensation for the time, risk and expense the breach causes them. Class actions allow many people with similar claims to pursue them together, which can make a case against a healthcare provider practical for people who could not afford to bring one alone.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
