CareOregon
ent_452109df9fe66ad80f0f9d18
Disclosures
6
State AG · HHS OCR · 1 jurisdiction
Multi-filing incidents
2
incidents joining 2+ filings here
Max affected reported
8,022
nationwide · State AG OR
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- CareOregon
- Normalized
- careoregon— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- No match
- SEC EDGAR CIK
- None — not an SEC registrant
- Domain
- careoregon.org
Disclosure history (6)newest first
- Oregon State AGas victim2025-12-26
CareOregon reported a data breach to the Oregon Attorney General. The breach was reported on 2025-12-26. The breach occurred during 5/25/2025 - 10/27/2025. The breach was discovered on 10/27/2025. 5,473 individuals were affected. Notice was sent on 12/26/2025.
- OREGONHHS OCRas victim2025-12-26
CareOregon, a health plan in Oregon, reported an unauthorized access/disclosure incident affecting 6,988 individuals. The breach involved access to a network server. No business associate was involved.
- OREGONHHS OCRas victim2025-05-30
CareOregon, Inc. reported to HHS on 2025-05-30 a Hacking/IT Incident affecting 1,786 individuals. Breached information located on Email. An employee was targeted by a phishing scheme exposing PHI including clinical, demographic, and financial data.
- Oregon State AGas victim2025-05-07
CareOregon, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2025-05-07. The breach occurred during 3/25/2025 - 4/1/2025. The breach was discovered on 4/7/2025. 1,768 individuals were affected.
- Oregon State AGas victim2022-10-05
CareOregon reported a data breach to the Oregon Attorney General. The breach was reported on 2022-10-05. The breach occurred during 8/8/2022 - 8/8/2022. The breach was discovered on 8/9/2022. 8,022 individuals were affected. Notice was sent on 9/26/2022.
- OREGONHHS OCRas victim2022-10-05
CareOregon (OR, Health Plan) reported to HHS on 2022-10-05 an Unauthorized Access/Disclosure affecting 8,022 individuals. Due to an error in its mail merging system, the CE mailed PHI — including names and health insurance information — to unintended recipients. Breached information was located on Paper/Films. The CE corrected the mail merging system and implemented additional administrative and technical safeguards, and notified HHS, affected individuals, and the media.