CareOregon October 2025 Data Breach (7 Thousand People Affected)

The October 2025 CareOregon data breach involved one or more people viewing certain member information without permission. The organization says some information may have been used to create fraudulent insurance claims, although this was not confirmed for every person.

The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as an unauthorized access/disclosure incident involving a network server and reported 6,988 affected individuals.

Verified Incident Timeline

CareOregon and Health Share of Oregon learned on or about October 27, 2025 that member information had been viewed without permission. In its December 26, 2025 notice, CareOregon identified the affected data types and the healthcare-service records members should review.

What Information May Have Been Affected?

The notice lists first and last names, dates of birth, health-plan information, Medicaid ID numbers, Medicare ID numbers where applicable, and primary-care provider office information. CareOregon says Social Security numbers and financial information were not viewed in this incident.

How the Organization Responded

CareOregon says it investigated and fixed the issue, changed how the information can be viewed, retrained staff, and notified law enforcement.

What Should Affected People Do?

Notice recipients should review the healthcare-service list and insurance records provided by CareOregon and report any service they did not receive. Contact details in incident-related calls, emails, or letters should be verified through CareOregon's official channels before recipients respond.