The Office for Civil Rights has been investigating Warby Parker for more than two years over its handling of the 2018 cybersecurity attack on thousands of its customer accounts, according to a disclosure the company filed ahead of its public offering expected later this week.
The investigation stemmed from an incident three years ago, in which “unauthorized parties” allegedly tried to access nearly 200,000 Warby Parker customer accounts for two months using username and password combinations from unrelated data breaches. At the time, Warby Parker had disclosed that hackers may have accessed stored prescriptions and customer profile data, although it hadn’t found proof this occurred.
Though Warby Parker disclosed the attack in 2018, the investigation hadn’t been made public until recently. Warby Parker’s S-1, a disclosure document all companies must file with the Securities Exchange Commission ahead of a public offering, shows that OCR, a division of the U.S. Department of Health and Human Services, opened an investigation and requested information about the incident in 2019.
