Ore. worker stored data of 36,000 people on private account

SALEM, Ore. (AP) – An Oregon Department of Revenue employee uploaded data on about 36,000 people to a private account, but officials said the information doesn’t appear to have been given to anyone else.

The staffer, who was not identified, uploaded at least one file containing names, addresses and Social Security numbers to a cloud storage service in late February, the agency said Friday. Security staff spotted the upload, froze the employee’s credentials and determined that none of the data appeared to have been accessed by any others.

Agency spokeswoman Joy Krawczyk says law enforcement was informed of the breach. As a precaution, the agency will offer all 36,000 people free identity theft recovery services, and add their names to a list requiring extra validation on tax transactions.

—

News release from the Oregon Department of Revenue:

SALEM, Ore.–The Oregon Department of Revenue has detected a security incident that involved approximately 36,000 individuals with records at the department.

The facts of the incident are summarized below, along with protective measures the department has taken since discovering the incident. The potentially impacted information from the files included data such as names, addresses, and Social Security numbers.

Because the Department of Revenue takes privacy and the confidentiality of taxpayer information seriously, it has strong information technology security processes in place, which enabled the department to quickly detect and contain the incident. The department has no indication that any personal information has been accessed or viewed by an unauthorized person, or used inappropriately. However, it is notifying the public as a precautionary measure.

What happened?

On February 21, 2018, a Department of Revenue employee uploaded work files to a personal cloud storage account. Department of Revenue’s information security staff identified the upload through routine log reviews. When the incident was detected, the employee’s computer was seized and all network accesses and credentials were immediately disabled. The employee was duty stationed at home and placed on paid administrative leave pending conclusion of a conduct investigation.

Department staff immediately launched a security investigation to determine the scope of the incident and the specifics of the information involved. Over the next several days, all files were deleted from the personal account. No evidence exists indicating the information was viewed or accessed by anyone other than department staff.

While all data was successfully retrieved, it took time to thoroughly review the information involved and determine the number of potentially impacted individuals, as there were many duplicate records.

What is the Department of Revenue doing?

The security and confidentiality of personal information is critical to the Department of Revenue. While there is no indication that any personal information has been accessed by an unauthorized person or used inappropriately, as an added precaution the department is providing identity theft recovery services for potentially impacted individuals. A vendor, ID Experts, will send individual notices to the potentially impacted individuals with instructions on how to register for the service.

The department is also adding the potentially impacted information into their identity theft risk file. Once added to this file, additional identity validation may be required when filing an Oregon personal income tax return. The department shares this file securely with numerous states’ tax departments to help prevent the information from being used to fraudulently file returns in other states.
Need more information?

For more information about protecting your identity, visit www.oregon.gov/dor and look under “Popular Topics.”