Oculus Pathology Data Breach Class Action Lawsuit Investigation
Data breach law firm Abington Cole + Ellery is investigating potential legal claims related to the Oculus Pathology data breach, which reportedly affected tens of thousands of individuals and may have exposed first and last name, in combination with one or more of the following: date of birth, Social Security number, driver’s license or state identification number, individual tax identification number, financial account number with or without access data, payment card number with or without access data, clinical data, provider name, health insurance policy number, health insurance group number, medical diagnosis data, treatment location, procedure data, medical treatment/procedure data, medical record number, Medicare number, patient ID, and/or prescription data.
JOIN THIS INVESTIGATION: If you are interested in potentially volunteering to serve as a class representative in a class action lawsuit against Oculus Pathology, please submit your information to be considered:
You may also open the form here: Oculus Pathology Data Breach Lawsuit Form. An attorney-client relationship is not formed by submitting information through this website.
Oculus Pathology Data Breach: Key Facts
| Company: | Oculus Pathology |
|---|---|
| Location: | Austin, Texas |
| Incident Type: | Employee-email-account compromise |
| Number Affected: | APPROXIMATELY 19,764 |
| Data Involved: | first and last name, in combination with one or more of the following: date of birth, Social Security number, driver’s license or state identification number, individual tax identification number, financial account number with or without access data, payment card number with or without access data, clinical data, provider name, health insurance policy number, health insurance group number, medical diagnosis data, treatment location, procedure data, medical treatment/procedure data, medical record number, Medicare number, patient ID, and/or prescription data |
| Date Began: | March 31, 2026 |
| Date Discovered: | April 1, 2026 |
| Date Ended: | April 2, 2026 |
| Notice Date: | On or about August 7, 2026 |
| Credit Monitoring: | UNCONFIRMED |
| Status: | Class Action Lawsuit Investigation |
What happened in the Oculus Pathology data breach?
Oculus Pathology announced a data security incident involving unauthorized access to a limited number of employee email accounts. According to the Austin, Texas-based pathology provider, the unauthorized access began on March 31, 2026, and continued until April 2, 2026. Oculus Pathology discovered suspicious activity associated with an employee email account on April 1, while the unauthorized access was still occurring. The company has not reported that its laboratory systems, patient portal, pathology operations, or entire computer network were compromised.
The precise cause of the Oculus Pathology data breach has not been publicly disclosed. Although compromised email accounts are sometimes associated with phishing, stolen credentials, or other account-access attacks, Oculus Pathology has not identified the method used in this incident. It also has not announced that ransomware was deployed, attributed the incident to a particular threat actor, or disclosed whether the attacker downloaded email messages or attachments. The confirmed fact is that an unauthorized party gained access to several employee email accounts during the three-day period. Oculus Pathology Notification Of Data Security Incident
After discovering the suspicious activity, Oculus Pathology secured its email environment and network and retained outside computer specialists to investigate. The investigation established the period of unauthorized access and led to a detailed review of the affected mailboxes. That review was undertaken to determine what information the accounts contained and identify the individuals connected to it. Oculus Pathology has described this process as extensive and time-consuming, and its public notice states that the examination of the potentially affected data remains ongoing.
The compromised email accounts may have contained personally identifiable information and protected health information. Depending on the individual, the information potentially involved included names, dates of birth, Social Security numbers, driver’s license or state identification numbers, individual taxpayer identification numbers, financial account numbers, payment card numbers, and related account-access information. Potentially affected medical information included clinical details, healthcare-provider names, diagnoses, treatment locations, procedure and treatment information, medical-record numbers, Medicare numbers, patient identification numbers, prescription information, and health-insurance policy or group numbers. Not every affected person necessarily had every category of information involved.
Oculus Pathology publicly announced the security incident on August 7, 2026, approximately four months after discovering the unauthorized activity. The company said it was notifying potentially affected individuals and would provide written notice when its review determined that a person’s information was involved. The Texas Attorney General's Data Security Breach Reports list the Oculus Pathology breach as affecting 19,597 Texas residents. The state record, published on September 3, 2026, reports that consumer notices were provided by U.S. mail. A nationwide total has not been publicly disclosed, so 19,597 should be described as the confirmed Texas count rather than the total number of people affected throughout the United States.
As of its public announcement, Oculus Pathology said it had found no evidence that the potentially affected information had been fraudulently misused or subjected to attempted misuse. This statement means that the company had not identified misuse at that time; it does not establish that information was never viewed, copied, or capable of later misuse. Oculus Pathology advised individuals to monitor their credit reports, financial statements, and health-insurance explanation-of-benefits forms for unfamiliar activity or errors. Its public notice does not announce an offer of complimentary credit monitoring or identity-theft protection.
Important dates in the Oculus Pathology data breach include March 31, 2026, when the unauthorized email access began; April 1, 2026, when Oculus Pathology detected suspicious activity; April 2, 2026, when the unauthorized access ended; August 7, 2026, when the company published its data security notice; and September 3, 2026, when the Texas Attorney General published the regulatory entry reporting 19,597 affected Texans. Oculus Pathology established a dedicated assistance line at 1-800-405-6108, available Monday through Friday from 8:00 a.m. to 8:00 p.m. Eastern Time, for individuals seeking additional information about the incident. Oculus Pathology Notification Of Data Security Incident
How did the Oculus Pathology breach occur?
The Oculus Pathology data breach occurred when an unauthorized party gained access to a limited number of employee email accounts. Oculus has not publicly disclosed how the intruder obtained access. Its notice does not identify phishing, stolen credentials, malware, ransomware, exploitation of a software vulnerability, or another specific entry method.
When did the Oculus Pathology breach occur?
According to the Oculus Pathology Notification Of Data Security Incident, the unauthorized access lasted from March 31 through April 2, 2026. Oculus detected suspicious activity associated with an employee email account on April 1, 2026, secured its email environment and network, and retained outside computer-forensics specialists to investigate.
How many people were affected by the Oculus Pathology breach?
The Oculus Pathology data breach affected 19,764 individuals nationwide, according to Oculus Pathology’s underlying record (BR-0005306) in the Texas Attorney General's Data Security Breach Reports. Of that total, 19,597 were Texas residents. The remaining 167 individuals were not included in the Texas-resident count.
What information was exposed in the Oculus Pathology breach?
- The compromised employee email accounts may have contained individuals’ names together with one or more of the following types of information:
- Dates of birth
- Social Security numbers
- Driver’s license or state identification numbers
- Individual taxpayer identification numbers
- Financial account numbers, with or without access information
- Payment-card numbers, with or without access information
- Clinical information
- Healthcare-provider names
- Health-insurance policy and group numbers
- Medical diagnoses
- Treatment locations
- Medical procedures and treatment information
- Medical-record numbers
- Medicare numbers
- Patient identification numbers
- Prescription information
Has Oculus Pathology offered free credit monitoring and/or identity theft protection services?
Based on the currently available public information, Oculus Pathology has not announced that it is providing complimentary credit monitoring or identity-theft protection services. The Oculus Pathology Notification Of Data Security Incident recommends monitoring financial statements, credit reports, and explanation-of-benefits forms. It also provides instructions for obtaining free credit reports and placing fraud alerts or credit freezes. However, those general protective measures are not the same as company-paid monitoring, and the notice contains no enrollment instructions, activation code, service provider, or coverage period.
It remains possible that certain recipients received an individualized offer in a mailed notification letter that has not been published online. Anyone who received a letter should review it for an enrollment code or contact Oculus Pathology’s incident-response line at 1-800-405-6108 to confirm eligibility.
Oculus Pathology data breach timeline:
| Date | Event |
|---|---|
| March 31, 2026 | An unauthorized party began accessing a limited number of Oculus Pathology employee email accounts. |
| April 1, 2026 | Oculus discovered suspicious activity potentially involving an employee email account. The company secured its email system and network and engaged third-party computer specialists to investigate. |
| April 2, 2026 | The period of unauthorized email-account access ended. Oculus reports that the affected accounts were accessible between March 31 and April 2, 2026. |
| April–August 2026 | The investigation determined that a limited number of employee email accounts had been accessed without authorization. Oculus and its specialists began reviewing the accounts to identify the information involved and the individuals to whom it related. |
| August 7, 2026 | Oculus published its Oculus Pathology Notification Of Data Security Incident. The company disclosed that the affected accounts might contain personally identifiable information and protected health information. It said its review remained ongoing and that it had found no evidence of actual or attempted misuse. |
| August 7, 2026 and after | Oculus began notifying potentially affected individuals and stated that it would send written notice when its investigation determined that a person’s information was involved. The publicly available notice does not establish a single completion date for all notifications. |
| September 3, 2026 | The Texas Attorney General's Data Security Breach Reports. The underlying record reports 19,764 affected individuals nationwide, including 19,597 Texans, and identifies U.S. Mail as the consumer-notification method. |
| Current status (as of September 3, 2026) | Oculus has stated that its investigation and review of potentially affected information remain ongoing. Its public notice reports no known fraudulent misuse, but the company has not publicly explained exactly how the unauthorized party obtained access to the employee email accounts. |
Who is Oculus Pathology?
Oculus Pathology, formerly known as Clinical Pathology Associates, is an anatomic and clinical pathology group headquartered in Austin, Texas, with roots dating to 1948. The organization provides diagnostic and laboratory services to hospitals, ambulatory surgery centers, physician practices, and clinical laboratories. Its board-certified pathologists examine more than 100,000 specimens annually across specialties that include surgical pathology, dermatopathology, hematopathology, molecular pathology, pediatric pathology, and urologic pathology.
What should you do if you received a Oculus Pathology data breach letter?
- Receiving an Oculus Pathology data breach letter means the company determined that your personal or protected health information may have been contained in employee email accounts accessed without authorization. Because the information involved differs by person, begin by reviewing the letter to identify which data elements were affected.
- Keep the letter and confirm it is authentic. Do not provide sensitive information in response to an unexpected email, text message, or telephone call. You can confirm the notice by calling its incident-response number at 1-800-405-6108.
- Consider freezing your credit reports. A credit freeze is especially appropriate if your Social Security number, taxpayer identification number, or driver’s license information was involved. Freezes are free, do not affect your credit score, and must be placed separately with Equifax, Experian, and TransUnion. FTC: Credit Freezes and Fraud Alerts
- Consider placing a fraud alert. A free, one-year fraud alert instructs prospective creditors to verify your identity before issuing new credit. Unlike a freeze, you need to contact only one credit bureau; that bureau must notify the other two. FTC: Credit Freezes and Fraud Alerts
- Review your credit reports. Obtain reports through AnnualCreditReport.com, the federally authorized source for free credit reports. Look for unfamiliar accounts, inquiries, addresses, or collection activity. Free online reports are currently available weekly.
- Monitor financial accounts closely. Review bank and payment-card activity for unauthorized transactions. If an account or card number was affected, ask the issuing institution whether it should be closed or replaced and whether additional security can be added.
- Watch for medical identity theft. Examine health-insurance statements, explanation-of-benefits forms, medical bills, prescription records, and patient portals for services or medications you did not receive. Contact the provider or insurer immediately if you find an error. Medicare beneficiaries should review their Medicare Summary Notices and report suspected misuse to 1-800-MEDICARE. Medicare.gov: Reporting Medicare fraud & abuse
- Protect your tax identity. If your Social Security number or individual taxpayer identification number was affected, consider obtaining an IRS Identity Protection PIN. An IRS IP PIN helps prevent someone else from filing a federal income-tax return using your identity.
- Be alert for targeted scams. Criminals may use medical, insurance, or personal information to make phishing communications appear legitimate. Do not disclose passwords, verification codes, Social Security numbers, Medicare numbers, or financial information unless you independently verified the recipient.
- Report suspected identity theft. If you discover fraudulent activity, contact the affected company or institution and submit a report through IdentityTheft.gov. The FTC will provide an identity-theft report and a personalized recovery plan.
- Document any resulting harm. Preserve the Oculus Pathology letter, disputed charges, credit reports, correspondence, receipts, and records of time spent addressing the incident. This documentation may be useful when disputing fraudulent activity, requesting reimbursement, or evaluating possible legal rights.
Sources and additional information about the data breach:
-
- Oculus Pathology Website
- Oculus Pathology Notification Of Data Security Incident
- Texas Attorney General's Data Security Breach Reports
- Medicare.gov: Reporting Medicare fraud & abuse
- FTC: Checking Your Credit Report
- FTC: Credit Freezes and Fraud Alerts
- AnnualCreditReport.com
- FTC Consumer Advice: Identity Theft
- IdentityTheft.gov
- IRS Identity Theft Guide for Individuals
- IRS Identity Theft Guide Central
- IRS: Get an identity protection PIN (IP PIN)
- U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
- IdentityTheft.gov: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach
Class Action FAQ
A class action lawsuit is a case brought on behalf of a group of people who were harmed in a similar way by the same company or organization.A class representative, sometimes called a named plaintiff or lead plaintiff, is a person who volunteers to bring the lawsuit on behalf of the larger group. They help represent the interests of everyone in the class. There may be more than one class representative in a class action.A person who was harmed may start a class action if many other people were harmed in a similar way.Usually, no. In many class action cases, the lawyers are paid only if the case is successful.Sometimes you do not need to do anything. Other times, you may need to submit a claim form by a deadline to receive money or benefits.
Oculus Pathology data breach infographic summarizing the number of people affected, the types of information involved, and the publicly confirmed timeline. Information current as of September 3, 2026.
About This Data Breach Resource
This page was created to give affected individuals and researchers a clear, comprehensive explanation of the Oculus Pathology data breach. It summarizes what is currently known about the incident, including the timeline, how the breach was discovered, the types of information involved, the number of people affected when available, important notice dates, and steps individuals may want to take after receiving a data breach notification.
This resource is independently written and organized to help readers understand the breach without having to review multiple notices, state attorney general filings, company statements, and related materials. When available, this page relies on primary sources and identifies key facts, unanswered questions, and updates as new information becomes public.
This page is especially relevant for readers searching for information about the Oculus Pathology data breach, Oculus Pathology data breach notice, Oculus Pathology class action investigation, what information was exposed, how many people were affected, and what affected individuals should do next.
Abington Cole + Ellery reviews data breach incidents involving sensitive personal information, financial information, and protected health information. This page is intended to help affected individuals understand the publicly reported facts, the types of information that may have been involved, and practical steps that may reduce the risk of identity theft or medical identity theft.
The information on this webpage is provided for general informational purposes only and does not constitute legal advice. Nothing on this page should be relied upon as legal advice for any particular situation. Submitting information through this page does not create an attorney-client relationship.
For more information about steps you can take to possibly reduce the risk harm arising from a data breach, please review the following article: What are some steps you can take if you've been the victim of a data breach?
This website is not associated with nor authorized by Oculus Pathology or any affiliated companies. If you have received any other data breach notifications, you may want to review Abington Cole + Ellery's current list of data breach investigations.