Oregon Zoo Data Breach Notice (Oregon Attorney General)

The Oregon Zoo has notified 117,815 people that their personal information was exposed in a data breach. If you received a letter from the zoo, this filing means your records were part of that incident.

What the Exposure Actually Means for You

The filing lists only one broad category: personal information. No passwords, no financial account numbers, no Social Security numbers, and no government identifiers were exposed. That is genuinely good news. The most common fears after a breach — identity theft using your SSN or someone draining a linked bank account — do not apply here.

What was exposed remains valuable to criminals for a different reason. Names combined with contact details and other personal information are frequently used to build convincing phishing messages, impersonate you to customer service departments, or create synthetic identity profiles over time. Even without permanent identifiers, this data can still make targeted scams more believable.

Why the Letter Is the Only Reliable Check

The Oregon Zoo is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely your information was not included. However, letters can go to outdated addresses. The filing does not state when the incident occurred, so there is no way to anchor a “have you moved” test to a specific date. The letter itself remains the clearest signal available. Anyone who has changed address since they last interacted with the zoo should contact them directly to confirm whether they were affected.

The Value of This Data Does Not Expire Quickly

Unlike credit cards that can be replaced, personal details such as your name, address history, phone number, or email addresses do not expire. Criminals can store this information and use it months or years later when you are less likely to connect a new scam to this particular breach. The scale — more than 117,000 people — shows how much information the zoo held on visitors, members, donors, and program participants.

Because no credentials were exposed, this incident does not put any online accounts at direct risk. You do not need to change passwords for your zoo account or any other service because of this filing.

What Criminals Can Do With Personal Information Alone

With enough personal details, attackers can:

• Craft phishing emails that reference your past zoo visits, membership tier, or specific programs you attended.
• Impersonate you when calling companies that use knowledge-based authentication.
• Combine your information with data from other breaches to build a more complete profile.

These risks are real but manageable. The absence of Social Security numbers or financial data significantly lowers the chance of immediate, high-impact identity theft.

How Long This Risk Lasts

The information taken in this breach will likely remain useful to fraudsters for years. People often lower their guard after the initial news cycle ends. The records that feel old to you are still fresh to someone building a long-term scam. Staying alert to unexpected contact that references your connection to the Oregon Zoo is one of the most practical protections.

Practical Steps That Address This Specific Exposure

• Treat any unsolicited contact claiming to be from the Oregon Zoo with caution. Verify requests by calling the zoo using a number from their official website rather than replying to emails or texts.
• Monitor your credit reports for new accounts opened in your name. Even without your SSN in this breach, determined fraudsters sometimes succeed through other routes. Free weekly reports are available from AnnualCreditReport.com.
• Be wary of phishing attempts that mention zoo memberships, tickets, donations, or events. These details make messages appear legitimate.
• Consider placing a fraud alert with the three major credit bureaus. A fraud alert requires creditors to verify your identity before opening new accounts and lasts for one year.
• Contact the Oregon Zoo directly if you have not received a letter but believe you should have. Updated contact information can help them reach you if any follow-up notifications are required.

This breach is a reminder that organisations holding even basic personal information have an obligation to protect it. For the 117,815 people named in this filing, the exposure is now permanent. What you do with that knowledge — how carefully you scrutinise future contact and how consistently you monitor for misuse — remains under your control.