Oregon
Table of Contents
- Identity Theft Statistics
- Top Ten Report Categories
- Top Identity Theft Types
- Fraud & Other Reports by Metropolitan Area
- Oregon’s Recent Biggest Data Breaches
- What Should You Do if You Are in a Breach?
- Step-by-Step Process for Responding to a Data Breach
- Responsibilities of Companies that Have Been Breached
- Laws
- Resources
Data breaches occur when unauthorized parties obtain sensitive or personal information for financial gain. Cybercriminals obtain this data in various ways, such as malware, phishing, stolen identities, hacking, or ransomware. This has been a prevalent issue in Oregon, considering the state Attorney General Rosenblum declared there had been an increase reported to his office in 2021.
Oregon is highly ranked in the country for data breach trends, and it ranks 25th in the number of victims per state nationwide. The losses incurred in 2023 were $136,052,036, illustrating the problem has progressed over the last few years. Common targets within the state include government institutions, healthcare, and educational facilities, as defined by the most significant breaches experienced.
Identity Theft Statistics
Reports
Reports
Losses
Top Ten Report Categories
Top Identity Theft Types
Oregon's Recent Biggest Data Breaches
Oregon DMV Hack
In June 2023, the Oregon Department of Transportation determined that their systems were exposed due to the hack on the transfer tool MOVEit. On discovery, they secured their network and assessed the areas where they were the most vulnerable or exposed due to the attack. The Department of Transportation is still working with state cybersecurity services and has engaged the assistance of third-party specialists to assist in the investigation. For residents, anyone with an active Oregon Driver's license, permit, or identity should assume that their information was exposed because of the breach. Oregon residents were advised to take immediate action by monitoring their accounts and obtaining credit reports.
Careoregon Paper/Films Breach
In August 2022, CareOregon determined an incident entailing the disclosure of its members' personal information. Marketing letters were sent to the wrong addresses of its members, and they had Protected Health Information. This incident involved 8,022 people. Some of the information exposed included member names, identification numbers, and dates of birth. The affected individuals were subsequently notified concerning the data breach. CareOregon indicated that it was a low-risk incident for identity theft or fraudulent activities.
Legacy Health
In July 2022, Legacy Health found that an employee in the office had saved files to external devices without authorization. Upon learning about the incident, the company suspended the personnel's access to the systems and began an investigation. Legacy Health also contracted a third-party forensics firm to help with the investigation. It was found that the employee transferred the company's documents to personal storage via email or external drives. Some information exposed included patient names, birth dates, medical record details, service dates, provider names, health insurance information, and treatment data. In November 2022, Legacy Health began mailing letters to all affected and offered complimentary credit monitoring. Eight thousand sixty-five patients were affected due to the breach.
Avamere Network Server Breach
Premere indicated that a network utilized by their business associate, Avamere Health, was breached in January 2022. An unauthorized party removed files and folders from Premere's network as well. Premere began a forensic investigation to assess what happened in May of the same year. It determined that specific information was compromised, including names, birth dates, Social Security numbers, addresses, driver's license details, medical information, and lab results. The company also started to notify the 183,000 affected individuals from the incident. It also advised that all affected people regularly check their credit or financial accounts.
Oregon Medicaid System Breach
In May 2019, the Oregon Health Authority and the Enterprise Security Office Incident Response Team determined a breach had happened. This resulted from a phishing email sent to an OHA state hospital employee, who opened it and exposed credentials to the unauthorized party. The email revealed protected health information belonging to hospital patients. Information included names, birth dates, medical records, treatment care plans, and other data used for treatment. The Oregon Health Authority reviewed the data breach event and provided clarity concerning all affected individuals. Though there was no indication that the protected health information was used for criminal purposes, the OHA notified all affected individuals.
What Should You Do if You Are in a Breach?
Unfortunately, data breaches are pretty common now, considering our online connections and dependence on digital service delivery. Criminals work in the shadows to steal your personal information, so sometimes, it's only when you notice certain signs that ongoing fraud becomes apparent. These danger signs apply to both individuals and businesses.
Unfamiliar
Credit Card Charges
If you find unauthorized transactions on your credit card, there is a significant possibility your phone number, email address, or card number has been compromised.
Calls from
Debt Collectors
Phone calls or letters from collection agencies seeking debt payment for a loan you do not remember taking are also signs of identity theft.
New Credit Cards
or Loans in Your Name
A new line of credit in your name or a loan taken is a warning sign you are a victim of identity theft.
Surprise Credit
Score Drops
Sudden credit drops with no obvious cause are a sign of suspicious activities.
Unusual Activity on Your
Social Security Account
The federal government also considers social security numbers personal identifiers, so check your social security statement regularly to ensure no one has access to benefits without consent.
Inability to
Sign-in to Accounts
If you are locked out of the account, it is usually because someone has hacked into it and changed the password. You should immediately try all possible recovery options and contact customer support if all fails.
Step-by-Step Process for Responding to a Data Breach
Contact Local Law Enforcement
As an individual or a business, report the incident to the police and file a police report.
Assess and Secure Compromised Areas
Identify which aspects of your information have been affected, such as emails, passwords, credit card numbers, social security numbers, full names, and phone numbers.
Contain the Breach
Isolate the affected system to prevent further damage.
Create New, Strong Passwords for All Accounts
This may involve changing usernames and passwords for compromised platforms, using strong passwords with a mix of upper and lower-case letters, digits, and special characters.
Notify Affected Institutions
Inform your bank, credit card companies, and other affected institutions. Request they close or freeze any accounts that may be implicated in the breach to reduce financial risk.
Update Security on Digital Accounts
Change passwords for all accounts affected by the breach. Make sure each password is totally unique, and you use two-factor verification as an additional layer of security.
Check for Malware
Examine your computers and mobile devices for installed malware. Install robust antivirus software to detect and remove any viruses or malicious software.
Freeze Your Credit
In cases of identity theft, contact all credit bureaus to freeze your credit.
Monitor Your Mail and Credit Reports
Keep an eye out for any unauthorized changes in your mail.
Engage Legal Assistance When Applicable
If you are a business, consider hiring a law firm experienced in handling data breaches.
Responsibilities of Companies that Have Been Breached
State regulations mandate that a company report a data breach to all affected within a short period. Reporting should occur within 45 days of finding out or receiving a breach notification. The breach notification must normally be sent in writing, but the company can issue an email-mailed notice if its customers have agreed to electronic notices.
A data breach affecting more than 250 people in the state of Oregon must be reported to the attorney general. They must notify consumer reporting agencies if that number is more than 1,000. A data breach notice sent out to residents has to include a description of the breach, the date, the type of information accessed, and contact details for the businesses and consumer reporting agencies. Forms sent to the attorney general include the incident dates, the number of those affected, descriptions of the data incident, and content of the notice sent to affected personnel.
There are cases when a substitute notice would be acceptable for Oregon businesses. Substitute notices are approved when the costs of sending traditional notices are more than $250,000, or over 350,000 people are affected by the incident. Similarly, a substitute notice can be issued if the business does not have enough contact details for those involved. This can be a conspicuous posting of the data breach event on the website, an email to those affected, and notifying Oregon media outlets.
Laws
- Oregon's Consumer Identity Theft Protection Actshows when and the manner businesses are to respond to a security breach. The breaches must be reported if there is a belief that residents' personal information is compromised.
- Oregon Senate Bill 583 details the law concerning the classification of personal information, security breach definition, attorney general notification, timing, and the notices required.
- Oregon Consumer Privacy Act maintains safeguards to protect the confidentiality and integrity of personal data. It also provides a means for consumers to revoke consent, which is as easy as it was provided.
Resources
- Federal Bureau of Investigation Internet Crime Report 2023
- Oregon Driver & Motor Vehicle Services
- Oregon Health Authority-External Relations Division
- Legacy Health- Notice of Privacy Incident
- Oregon Department of Justice- Consumer Protection
- Oregon's Consumer Identity Theft Protection Act
- Oregon Senate Bill 583
- Oregon Consumer Privacy Act (S.B. 619