Oregon reveals data breach affected hundreds in welfare, children’s programs

The Department of Human Services in Salem, Oregon. Beth Nakamura/Staff

The Oregon agency that runs the state’s foster care and welfare programs announced on Thursday afternoon that the personal information of more than 350 people in those programs might have been comprised, after a Jan. 28 data breach.

An unidentified attacker gained access to the state’s records after nine employees at the Department of Human Services opened so-called “phishing” emails and clicked on a link that allowed the outside party to gain access to their state email accounts, according to a state press release.

The state did not say specifically how many Oregonians might be affected. It did say the breach involved their protected health information. Examples of the types of information that might have been compromised includes first and last names, addresses, dates of birth, Social Security numbers and case numbers.

"At this point, it involves all of our programs,” agency spokesman Robert Oakes said on Tuesday afternoon. “Primarily (the Aging and People with Disabilities Program), child welfare, self-sufficiency and vocational rehabilitation.” The agency is checking to see if information was compromised in the program for children and adults with intellectual and developmental disabilities, Oakes said.

The state hired a contractor, IDExperts, to perform a forensic review to figure out the exact number and identities of Oregonians whose information was exposed. Oakes said that firm will also contact the people who were affected and inform them of the availability of free credit monitoring services. The state notified news media of the breach on Thursday in order to comply with a state law that requires entities involved in a data breach to notify people who were affected “in the most expeditious manner possible, without unreasonable delay.”

In a press release, Oregon House Republican Leader Rep. Carl Wilson took the agency to task for not notifying the public sooner.

“Transparency continues to be a systemic problem at DHS," said Wilson, of Grants Pass. “Protection of personal information they are required to provide the state should be given the highest priority. Beyond that, we’re seeing a growing accountability issue when DHS fails to quickly inform the public about embarrassing matters.”

With more than 8,000 employees, the Department of Human Services is the largest state agency, with programs including foster care, food stamps and cash assistance also known as welfare.

Oregon state government has experienced several data breaches in recent years. A year ago, Oregon’s tax agency revealed an employee had copied the personal information of 36,000 people. There were also security breaches at the Secretary of State’s office and Employment Department in 2014 and the state data center in 2015.

— Hillary Borrud | hborrud@oregonian.com | 503-294-4034 | @hborrud

Visit subscription.oregonlive.com/newsletters to get Oregonian/OregonLive journalism delivered to your email inbox.

If you purchase a product or register for an account through a link on our site, we may receive compensation. By using this site, you consent to our User Agreement and agree that your clicks, interactions, and personal information may be collected, recorded, and/or stored by us and social media and other third-party partners in accordance with our Privacy Policy.