CareOregon, Inc. Data Breach Notice (Oregon Attorney General)

The March 25, 2025 breach at CareOregon, Inc. means that personal information belonging to 1,768 people is now outside the organisation’s control. The filing reached the Oregon Department of Justice on May 7, 2025 — 43 days later. Because the company is required to notify affected individuals directly, the letter you may or may not have received is the only reliable way to know whether your records were included.

Personal information carries permanent risk

The record lists personal information as exposed. No passwords, no financial account numbers, and no permanent government identifiers such as Social Security numbers appear in the disclosed categories. That is genuine good news. It sharply limits what an unauthorised party can do with the data alone.

Even so, names, dates of birth, addresses, phone numbers, email addresses and other personal details remain valuable for identity thieves. They can be combined with information obtained elsewhere to build convincing profiles for account takeover, loan fraud, or tax-refund scams. Once released, this type of information cannot be recalled or reissued.

What the 43-day gap actually tells you

The incident occurred on March 25 and the filing was made on May 7. The record contains no discovery date, so it is impossible to know how long the data was accessible before CareOregon learned of the problem. The 43-day interval between the stated incident date and the regulatory filing is simply the period the organisation took to investigate, contain the issue, and prepare notifications. State law allows a reasonable time for that work; nothing in the filing characterises it as delayed or prompt.

Why medical identifiers still matter here

CareOregon is a health insurer and coordinated care organisation. Even though the filing uses the broad term “personal information,” records held by such an organisation almost always tie to healthcare history, policy numbers, or claims data. Medical identifiers do not change like a credit card number. A determined fraudster can use them years later to file false claims, order prescription drugs, or create counterfeit insurance cards. The absence of explicit medical categories in the summary does not eliminate that long-term exposure; it simply reflects how the filing was written.

How to determine whether you were affected

CareOregon must send written notice to every person whose records were included. If you have not received a letter at your last known address, it is likely your information was not part of this incident. However, if you have moved since March 25, 2025, the letter may have gone to an old address. In that case, contact CareOregon directly using the customer service number on your insurance card or the contact details in the filing to confirm your status.

The exposure cannot be undone, but its usefulness can be limited

Because no passwords or account credentials were exposed, you do not need to change any CareOregon password. The real work lies in reducing what thieves can build from the personal details now in circulation.

• Place a freeze on your credit reports at Equifax, Experian, and TransUnion. This stops new accounts from being opened in your name even if someone has enough personal information to apply.
• Review Explanation of Benefits statements from CareOregon for any claims you did not file or authorise. Medical identity theft often shows up first as unexpected bills or services.
• Monitor your bank and credit-card accounts for small test charges that fraudsters sometimes use before larger theft. Set up transaction alerts if you have not already done so.
• Be wary of unsolicited calls, texts, or emails that reference your CareOregon coverage. Scammers frequently use stolen personal details to sound legitimate.
• File your taxes early next year. This reduces the window in which someone could file a fraudulent return using your information.

The breach notification itself does not reveal how the incident occurred, whether the actor was external or internal, or how long any unauthorised access lasted. Those details remain unknown to the public. What is known is narrow but concrete: personal information for 1,768 individuals left CareOregon’s systems on or around March 25, 2025. The letter in your mailbox — or its absence — remains the clearest signal of whether that group included you.