tucsoneyecare.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On February 13, 2023, the healthcare practice operating as tucsoneyecare.com was listed by the ransomware group known as lockbit3. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further specifics have not been disclosed.

The listing itself constitutes a claim by the group rather than independent confirmation of every detail. For patients and others connected to an eye-care practice, any unauthorized access to internal files raises clear questions about the possible exposure of personal and clinical information, even when the precise scope is still limited in public accounts.

What happened

According to available information, tucsoneyecare.com appeared on a lockbit3 leak site on or around February 13, 2023. The incident is described as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the volume of data taken, the exact date the intrusion began, or the technical method used to gain access. The number of individuals potentially affected is listed as unknown. Beyond the group’s claim that internal files were removed, additional operational details have not been released in the material provided.

The group behind it: lockbit3

Lockbit3 is a well-documented ransomware operation that has appeared in numerous public incident reports since its emergence as an evolution of earlier LockBit activity. The group typically gains access to networks, steals data, encrypts systems, and then threatens to publish the stolen material on a dedicated leak site unless a ransom is paid. It has been associated with attacks across multiple sectors, including healthcare, and is known for operating in an affiliate model in which different actors carry out intrusions under the LockBit brand. In this case, the group’s listing of tucsoneyecare.com is presented as its own claim that the organization was victimized and that internal files were taken; independent verification of the full extent of that claim is not contained in the reported facts.

About tucsoneyecare.com

Tucson Eye Care, operating under tucsoneyecare.com, is an eye-care practice that describes itself as committed to integrating current technology to deliver compassionate, state-of-the-art care to patients. Organizations of this type routinely maintain patient scheduling systems, clinical records, billing information, and administrative files. Because eye-care practices handle both medical and personal data, a ransomware incident that involves exfiltration of internal files carries particular weight: the information is often sensitive, retained for extended periods, and subject to healthcare privacy expectations. The practice’s own public statement emphasizes technology and patient care, underscoring why disruption or data exposure in this setting can affect both clinical operations and individual privacy.

What was likely exposed

The reported facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, patient counts, or specific data categories has been disclosed. Eye-care practices commonly hold names, contact details, dates of birth, insurance information, appointment histories, clinical notes, prescriptions, and billing records. It is therefore reasonable to expect that some combination of administrative and clinical material could have been among the internal files taken, yet the exact contents remain unconfirmed. Public detail does not identify whether medical images, financial data, or employee records were included, and no inventory of the stolen material has been released.

Why it matters

For individuals whose information may have been involved, the primary risks include potential misuse of personal identifiers, targeted phishing that references real clinical details, and longer-term concerns about medical privacy. Even when the full scope is unknown, the mere fact of exfiltration means data could circulate beyond the organization’s control. For the practice itself, a ransomware event can interrupt scheduling, billing, and patient communications, create regulatory notification obligations, and erode trust. Because the number of people affected has not been established, the practical impact ranges from limited administrative exposure to broader patient-data concerns; until more information surfaces, affected parties must treat the possibility of exposure seriously without assuming the worst undocumented scenarios.

What to do if you're exposed

If you have been a patient or otherwise connected to Tucson Eye Care, begin by monitoring account statements and insurance explanations of benefits for unfamiliar activity. Consider placing a fraud alert with the major credit bureaus and reviewing any clinical or billing correspondence for signs of misuse. Change passwords on related online portals and enable multi-factor authentication where available. Keep records of any suspicious contacts that reference your eye-care history. Finally, you can run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which provides an additional, concrete step for assessing personal exposure.

AICompiled with AI assistance from public sources and published under our editorial standards.