Anatomy of a breach

November 20, 2025

How cyberattacks unfold in optometric practices.

Tag(s): Practice Management, Perfect Your Practice

Cybercrime Breach Illustration

Key Takeaways

Cyber criminals can access practice data through social engineering, vendor vulnerabilities, or outdated security, leading to expensive disruptions and patient data exposures.

Understanding how these attacks unfold can help optometrists better prepare for the cyber threats that face their practices.

Cyberattacks on optometric practices aren’t abstract risks; they’re real-world events that can halt patient care, jeopardize compliance with legal regulations, and cost thousands in recovery. Consider the following breach scenarios and how comprehensive cyberliability insurance coverage can help ease the financial and emotional burden of breach response.

Scenario 1: Phishing trap

Your staff member receives an email that appears to be from your EHR vendor, requiring a password update. The link directs to a fake but convincing login page. Your staff member inputs your current login credential and within hours, hackers use those credentials to access patient data, download files, and encrypt your systems. Your practice cannot access charts or schedules, and you receive a demand for cryptocurrency in exchange for access to your practice’s systems and data. Patient care is interrupted, and you face the costs associated with restoring your systems, patient notifications, and legal counsel.

Scenario 2: Compromised vendor

Your billing contractor’s system is breached, exposing patient insurance information connected to your practice. Although the vendor was responsible, your practice is still required under HIPAA to report the breach and notify patients that their data has been compromised. You spend hours coordinating with the billing contractor and regulators to determine the appropriate response. Patients lose confidence in your practice’s data security. You face the unexpected costs of public relations support to help you notify patients and craft messaging that reestablishes trust in your practice.

Scenario 3: Outdated firewall

Your firewall is overdue for an update to patch a known vulnerability. A cybercriminal takes advantage of the vulnerability to access your network and steal patient health and financial data to sell on the dark web. Your managed service provider (MSP) notices that an unusual data transfer to a foreign IP address occurred outside of regular business hours and notifies your practice of the breach. You are required to notify regulators of the breach, contact affected patients, provide credit monitoring, and a legal claim is filed against your practice.

How can cyberliability insurance help?

Scenarios such as these are more common than you might think, especially because 74% of data breaches are attributable to human error. The right cyberliability insurance policy can significantly reduce the costs and headaches that come with cyberincident response. AOA members have access to cyberliability insurance coverage designed for optometric practices through Lockton Affinity. Lockton Affinity has partnered with a cyberinsurance industry leader to provide access to a network of experts in cyberforensics, public relations, credit monitoring, and cyberincident-related legal issues. This robust coverage helps to mitigate the financial burden of a cyberincident and allows practice owners to quickly return to patient care.

View Cyber Insurance Options & Pricing

^{The AOA Insurance Alliance is administered by Lockton Affinity, LLC d/b/a Lockton Affinity Insurance Brokers LLC in California #0795478. Coverage is subject to actual policy terms and conditions. Policy benefits are the sole responsibility of the issuing insurance company. Coverage may be provided by an excess/surplus lines insurer which is not licensed by or subject to the supervision of the insurance department of your state of residence. Policy coverage forms and rates may not be subject to regulation by the insurance department of your state of residence. Excess/Surplus lines insurers do not generally participate in state guaranty funds and therefore insureds are not protected by such funds in the event of the insurer’s insolvency. The American Optometric Association will receive a royalty fee for the licensing of its name and trademarks as part of the insurance program offered to the extent permitted by applicable law.}