PORTLAND, Ore. — Hackers were able to access the personal information of about 1.7 million Oregon Health Plan (OHP) members, the Oregon Health Authority (OHA) said Wednesday morning.
Performance Health Technology (PH Tech), a private company that works for health care providers, said hackers broke into the system through a security vulnerability in Progress MOVEit software. It's the same software that was involved in a global cyberattack in late May that impacted the Oregon Driver and Motor Vehicle Services and the Umpqua Bank.
PH Tech said it was told about the problem on June 2, immediately moved their system offline and began an investigation. The investigation revealed that hackers accessed personal information, including names, date of birth, social security numbers, addresses, and member ID and plan ID numbers. Some health information was also accessed, like enrollment and claims files.
The company believes the hack happened on May 30. Progress MOVEit made a disclosure of the vulnerability on May 31 and deployed a patch the same day.
PH Tech said it found out June 16 that its customers' personal data had been accessed, and it began alerting customers the same day — although OHA said PH Tech started sending letter notifications on July 31.
“We’re urging OHP members to activate credit monitoring as a precaution,” said Dave Baden, interim director at OHA. “It’s disheartening that bad actors are looking to exploit people in our state and that their actions create a burden for others, who have more than enough to manage already. However, there are important steps that OHP members can take to further protect their data.”
The data breach didn't compromise state systems, PH Tech said.
What to do if your personal information was compromised
The OHA is advising OHP members to take steps to protect their personal information. The agency provided the following tips below:
- Watch for additional information from PH in the mail and follow instructions to activate 12 months of free identity theft protection. OHP members will be contacted by regular first-class mail, not by phone or email.
- Request a free credit report. OHP members have the right to request one free copy of their credit report from each of the three major consumer reporting companies (Equifax, TransUnion and Experian) every year. OHP members may be able to request reports from one company every few months throughout the year. Credit reports and monitoring can help people identify signs of identity theft and stop thieves from using information for fraudulent purposes.
- Contact PH TECH for assistance at 888-498-1602 or by going to https://response.idx.us/PHTECH for more information.
OHP members can also receive free ID theft recovery services from PH Tech, according to the OHA.
