Portland — Personal data of more than 645,000 clients of Oregon’s Department of Human Services was compromised during a January data breach, the agency disclosed Tuesday. This number is significantly higher than the agency’s original report in March that the number of people affected “exceeded 350,000.”
The breached client information potentially includes first and last names, addresses, dates of birth, Social Security numbers, case numbers, personal health information and other information used in DHS programs, the agency said in a news release. The personal health information includes protected health information that is due special protection under federal health privacy laws. Not all of these information types were exposed for each person.
After discovering the breach in January, the department hired a team of 70 attorneys and paralegals to read and sort the 2 million susceptible emails, Jake Sunderland, the agency’s spokesperson said Tuesday. When the department announced the breach in March, the legal team still hadn’t finished their investigation, hence the much lower figure of 350,000 clients impacted, he said. The department finished the investigation earlier this week, he said.
The department said it will provide 12 months of identity theft monitoring and recovery services, including a $1 million insurance reimbursement policy, to individuals whose information was accessible. A private firm with expertise in identity theft, MyIDCare, will perform those services for affected clients, the news release said.
