Eyemart Express data breach: employee payroll files, and 189,432 people on Indiana's list

What happened at Eyemart Express?

Eyemart says it opened an investigation straight away, but could not identify the affected files with reasonable certainty until on or about March 17, 2026. It then analysed the records to identify the people affected. It says it is cooperating with federal law enforcement.

Date	What the letter and the regulators' records say
February 12, 2026	Unauthorized access to Eyemart's systems
February 13, 2026	Eyemart learns of the incident and contains it
On or about March 17, 2026	Affected files identified
May 18, 2026	Report to HHS (25,000)
July 15, 2026	Letter date; Indiana notice (189,432 total; 2,637 in Indiana)
July 24, 2026	Logged in Massachusetts (5 residents)

Why do the counts differ so much?

The HHS figure, 25,000, is a round number filed two months before the letters. Indiana's later total is more than seven times larger. Neither record explains the gap, or says how many of the 189,432 are customers and how many are staff.

What information was involved?

The Massachusetts sample is the employee version. It says the files include information tied to the reader's employment, among it name and payroll information, with other items filled in on each letter. For the 5 Massachusetts residents in Eyemart Express' notice, the state's record marks Social Security numbers, medical records, financial accounts and driver's licenses as breached.

What is Eyemart offering?

Item	Detail from the letter
Service	IDX identity protection: credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and managed identity theft recovery; the sample leaves the term as 12 or 24 months
Enrollment deadline	October 15, 2026 (passed)
Enroll or ask questions	1-866-200-0991, Monday to Friday, 8 a.m. to 8 p.m. Central Time, excluding U.S. holidays; or app.idx.us/account-creation/protect

The guide to credit monitoring offers sets Eyemart Express' offer beside other letters.

What Texas's attorney general recorded

Texas's attorney general lists a report from Eyemart Express, LLC, posted on July 21, 2026, with 45,460 Texans affected, a count of Texas residents only. The record lists names, addresses, Social Security numbers, driver's license numbers, financial account or card information, medical information, health insurance information and dates of birth as involved.

What Washington's attorney general recorded

Washington's attorney general lists a report from Eyemart Express, LLC, received on July 24, 2026, with 1,704 Washington residents affected and a breach date of February 12, 2026. For those residents the record lists names, Social Security numbers, driver's license or state ID numbers, financial and banking information, dates of birth, passport numbers, health insurance numbers, medical information and protected health information as compromised.

What the documents leave open

• How the intruder got in during the one day of access.
• How many customers, as opposed to employees, are among the 189,432.
• What customer letters, if any, say.

With 25,000 people, Eyemart Express' report is the 107th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.