Almeida Law Group is investigating a data breach at Eyemart Express, LLC. The breach occurred on February 12th–13th, 2026 and was discovered on March 17th, 2026. If you were affected, contact Almeida Law Group.
About Eyemart Express, LLC
Eyemart Express, LLC is a national retail optical chain founded in 1990 and headquartered in Farmers Branch, Texas. The company operates nearly 250 stores across more than 40 states, offering prescription eyeglasses, frames, lenses, and vision exam services under brand names including Vision 4 Less, Visionmart Express, and Eyewear Express. It was acquired by VSP Vision in October 2024. Because Eyemart Express provides vision care services, it collects the kind of sensitive personal, financial, and medical information that was confirmed to have been compromised in this incident.
What Happened?
Eyemart Express, LLC was listed in a Texas Attorney General data security breach report (record ID BR-0005190, published July 21st, 2026). The incident affected 189,450 individuals in total. According to the filing, the following categories of information were involved: name, address, Social Security number, driver’s license number, financial account information, medical information, health insurance information, and date of birth. Eyemart Express notified affected consumers by U.S. Mail and by publication in print media.
The ransomware group known as “Payouts King” (also styled “PayoutsKING”) claimed responsibility for the attack on March 10th, 2026 via a dark web posting, alleging it had exfiltrated approximately 435 GB of internal data. This claim was reported by cybersecurity monitoring platform Rankiteo and tracked by BreachSense, which attributed the incident to that threat actor. These are attacker-side allegations and have not been confirmed by Eyemart Express or any regulator. A class action lawsuit, Lewis v. Eyemart Express LLC (Case No. 3:26-cv-01402-D, U.S. District Court for the Northern District of Texas), was filed on April 30th, 2026. The complaint, brought by plaintiff Lisa Lewis, alleges negligence, breach of implied contract, and unjust enrichment, and claims the company failed to comply with HIPAA and FTC guidelines. The lawsuit also raises concern about delayed consumer notification — as of April 17th, 2026, when the breach was reported to the Texas Attorney General, consumers had reportedly not yet been notified, despite the breach having occurred more than two months earlier. Multiple other law firms have also publicly announced investigations. A separate, earlier lawsuit filed in March 2024 — Rand et al. v. Eyemart Express LLC (Case No. 3:24-cv-00621-N, N.D. Tex.) — alleged that Eyemart Express used Meta’s Pixel tracking tool to intercept and share users’ personal health information without consent; that matter is distinct from this cybersecurity incident.
Key Facts at a Glance
- Company or Organization: Eyemart Express, LLC
- Industry: Retail optical / eyewear; classified by the Texas Attorney General as Healthcare – Medical Provider
- Location: Farmers Branch, Texas
- Incident type: Data breach (ransomware group “Payouts King” claimed responsibility; attacker attribution not confirmed by the company)
- Date of breach: February 12th, 2026 – February 13th, 2026
- Date breach discovered: March 17th, 2026
- Date of consumer notification: Notice provided by U.S. Mail and publication in print media; consumers reportedly not yet notified as of April 17th, 2026
- Total persons affected: 189,450
- Prior breach: A 2024 lawsuit (Rand et al. v. Eyemart Express LLC) alleged unauthorized sharing of personal health information via Meta Pixel web tracking; that matter is separate from this incident
- Litigation status: Lewis v. Eyemart Express LLC, Case No. 3:26-cv-01402-D (N.D. Tex.), filed April 30th, 2026; multiple additional law firm investigations announced
- Source: Texas Attorney General data security breach report, BR-0005190 (https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage#BR-0005190); Top Class Actions (https://topclassactions.com/lawsuit-settlements/lawsuit-news/eyemart-express-sued-over-alleged-failure-to-safeguard-patient-information-in-data-breach/); BreachSense (https://www.breachsense.com/breaches/eyemart-express-data-breach/); VSP Vision (https://www.vspvision.com/newsroom/company-news/company-announcements/vsp-vision-completes-eyemart-express-acquisition)
What Should You Do?
If you received a notice from Eyemart Express, review it carefully for enrollment details regarding any identity theft protection being offered and enroll before any stated deadline. Because Social Security numbers, financial account information, medical information, and health insurance information were among the data types confirmed in the breach, you should consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitoring your credit reports closely. You can request free annual credit reports at AnnualCreditReport.com. Watch your bank and credit card statements for unfamiliar charges. Because medical and health insurance information was involved, also review your Explanation of Benefits statements and check your medical records for services you did not receive. If you suspect misuse of your information, visit IdentityTheft.gov for step-by-step guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
