PORTLAND, OR (KPTV) - The Oregon Department of Human Services is notifying 645,000 people by mail about a data breach that may have compromised their personal information.
The data breach occurred in January 2019. The agency reports that it is not known if the compromised information, which includes personal health details and social security numbers for clients, was viewed or used inappropriately.
A phishing email was sent to DHS employees on Jan. 8. Nine employees opened the email and clicked on an included link, which gave the sender access to their email accounts.
Access to those nine accounts was stopped on Jan. 28. An investigation confirmed no other email accounts were compromised and no malware was installed on department computers.
Initial review of the incident indicated up to 2 million emails might be involved. After the breach was contained, the department began its electronic forensic investigation and analysis to identity exactly what data was compromised. An outside firm, ID Experts, was hired for data analysis.
Once it was confirmed that the compromised data included personal information, the department created an incident call center and website with information about the breach. The public was initially notified March 21.
Most client information involved in the breach was in email attachments, like reports. The exposed client information includes first and last names, addresses, dates of birth, Social Security numbers, case numbers, personal health information and other information used in DHS programs. The personal health information includes Protected Health Information, covered under the Health Insurance Portability and Accountability Act.
Not all of these information types were exposed for each person.
DHS will begin sending individual notices starting Wednesday. The agency is providing ID theft monitoring and recovery services to those affected. DHS is also providing a $1 million insurance reimbursement policy to people whose information was accessible. The notices will include enrollment instructions.
For more information, go to ide.myidcare.com/oregonDHS.
Copyright 2019 KPTV-KPDX Broadcasting Corporation. All rights reserved.