Adapt Oregon Health Care Data Breach Notice (Oregon Attorney General)

The filing from Adapt Oregon Health Care, submitted to the Oregon Department of Justice on February 24, 2026, states that a data breach occurred on January 01, 2001, affecting 2,908 people. That interval — more than 25 years — is the single most striking fact in the record.

25 Years Passed Between the Incident and the Notification

The breach happened on the first day of 2001. The organisation did not file this notice until February 2026. The record contains no discovery date and offers no explanation for the gap. Notification timelines vary by state law and the length of any investigation, so the filing itself does not prove fault. What it does prove is that anyone whose records were involved waited more than two decades for official word.

If you received a letter from Adapt Oregon Health Care, your personal information was included in that 2001 incident. The organisation is required to notify affected individuals directly, usually by post. Absence of a letter usually means you were not in the affected group. However, if you have moved since January 2001, the letter may have gone to an old address. In that case, contact the organisation directly to confirm whether your records were involved.

What the Filing Actually Lists as Exposed

The record names only one category: personal information. No passwords, no financial account numbers, no driver’s license numbers, and no health records beyond the generic label are specified. This is genuine good news. Because no credentials were exposed, there is no need to change any password connected to Adapt Oregon Health Care as a result of this incident.

Personal information in this context almost always includes name combined with one or more persistent identifiers such as date of birth or Social Security number. These pieces do not expire. Once they leave an organisation’s control they remain usable for identity theft, fraudulent tax returns, or medical identity fraud for decades.

Why the Long Delay Changes the Risk Picture

A breach that took place in 2001 and was only disclosed in 2026 means the exposed personal information has had a full generation to circulate. Criminal markets, data brokers, and fraud rings have had 25 years to incorporate it into larger identity profiles. The information is no longer “newly stolen.” It is old, well-travelled data that may already sit in multiple underground databases.

That permanence is what matters most to you now. You cannot make the exposed personal information disappear. You can only reduce what criminals can do with it when they inevitably pair it with newer records bought on the dark web or obtained through fresh breaches.

The Concrete Risks That Remain in 2026

With only personal information confirmed, the primary ongoing threats are synthetic identity fraud, tax refund fraud, and medical identity theft. A criminal who already holds your name and date of birth from 2001 can use any new breach that adds a fresh piece — such as a recent address or phone number — to build a convincing enough profile to open accounts or file fraudulent returns in your name.

Medical identity theft is also a realistic concern for anyone treated by this organisation. Someone could use your personal details to obtain care, after which insurance statements and bills would arrive in your name. These incidents can quietly damage your medical history and credit for years before they are noticed.

What You Can Still Control

Even with 25 years of circulation, several practical defences remain effective. The goal is to make your personal information harder to combine with new data and easier to spot when it is misused.

• Place a freeze on your credit reports at Equifax, Experian, and TransUnion. This stops new accounts from being opened in your name without your explicit permission. It is the single most effective step for this type of exposure.
• Monitor your tax transcripts annually. Request a transcript from the IRS every year to catch fraudulent filings before refunds are issued in your name.
• Review Explanation of Benefits statements from every health insurer you have used since 2001. Look for services you did not receive. Medical identity theft often surfaces first in these documents.
• Set up alerts on all three credit reports so you receive immediate notice of any new inquiry or account.
• Contact Adapt Oregon Health Care directly if you moved at any point after January 2001 and never received a notification letter. Ask them to confirm whether your specific records were in the affected group.

The 2,908 people named in this filing have carried unknown risk for most of their adult lives. The long silence does not change what happened in 2001, but it does change how you should think about the data today. Treat the exposed personal information as permanently public and build your defences around that reality rather than hoping the information stayed hidden.