Oregon Department of Human Services oregon.gov Oregon Department of Human Services data breach: what happened and what to do
In January 2019, phishing emails gave attackers access to Oregon Department of Human Services employee accounts. HHS lists at least 625,000 people. Names, addresses, birth dates and Social Security numbers were among the data exposed.
View all 13,177 breaches- Breach date
- Jan 2019
- Made public
- 22 Mar 2019
- Affected
- 625,000
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
The Oregon Department of Human Services told the U.S. Department of Health and Human Services (HHS) that numerous workforce members fell for an email phishing scheme. HHS lists a minimum of 625,000 people as affected. Later news reports, including BleepingComputer, put the figure near 645,000 after the agency raised its estimate in June 2019. According to those reports, the phishing happened in January 2019, and the affected accounts were secured by 28 January.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS says the information included names, addresses, birth dates, Social Security numbers and other identifiers. Reports add that case numbers and some health information were in the affected email.
The department notified HHS, affected individuals and the media. According to news coverage, it offered 12 months of identity theft monitoring and recovery services. It added administrative and technical safeguards and retrained staff to recognize fraudulent emails.
Why it matters
The agency said it could not confirm that anyone misused the data. Even so, a Social Security number and birth date are what thieves use to try to open accounts in someone's name, and case details can make scam calls sound official.
If you received a notice, take the credit monitoring offer and freeze your credit.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze stops lenders from seeing your report, which blocks most new accounts opened in your name. The FTC says it's free, lasts until you lift it, and you place it separately at Equifax, Experian and TransUnion. Lift it only when you apply for credit yourself.
- 2
Take the offered identity theft monitoring
If your notice letter included free monitoring or recovery services, the FTC recommends using them. Enroll through the instructions in the letter.
- 3
Read your statements and insurance explanations of benefits
Look for charges, accounts or treatment you don't recognize. If something is wrong, report it at IdentityTheft.gov, the FTC's reporting site, which also builds a recovery plan for you.
- 4
Expect phishing that mentions the breach
Scammers use real details to sound legitimate. The FTC advises you not to click links or call numbers in unexpected messages; contact the organization using a number from its official website instead.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan against breach databases and the dark web and alerts you if your email or phone number shows up. Serus can't remove data from a breach, but it tells you when to change a password or watch for phishing.
Official filings
- U.S. Department of Health and Human Services , filed 22 Mar 2019 : 625,000 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
How many people were affected?
HHS lists at least 625,000 people. Later news reports put the figure near 645,000.
What was exposed?
Per HHS: names, addresses, birth dates, Social Security numbers and other identifiers.
Was my data misused?
The department said it could not confirm that anyone misused the data, according to news coverage. Freezing your credit is still the safest precaution.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
- consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
- bleepingcomputer.com/news/security/phishing-attack-exposes-data-of-645-000-oregon-dhs-clients
Something wrong or out of date? Tell us and we'll re-check it.
