Breachesby GlyphCareOregon
Disclosed May 7, 20256,988 affectedConfirmed
The covered entity (CE), CareOregon, Inc., reported that an employee was the target of an email phishing scheme that affected the protected health information (PHI) of 1,786 individuals. The PHI involved clinical, demographic and financial information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE provided security awareness training to its workforce and strengthened its threat detection and response solutions to better protect its PHI. OCR provided technical assistance to the CE regarding the HIPAA Rules.
What is known
| People affected | 6,988 (as reported to HHS) |
|---|---|
| Disclosed | May 7, 2025 |
| Discovered | Oct 27, 2025 |
| Happened | May 25, 2025 |
| Attack | Insider |
| Data exposed | NamesHealth |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
Notices filed
Other breaches at CareOregon
History of this record
empty to The covered entity (CE), CareOregon, Inc., reported that an employee was the target of an email phishing scheme that affected the protected health information (PHI) of 1,786 individuals. The PHI involved clinical, demographic and financial by backfillSource
other to insuranceby backfillSource
unknown to insiderby backfillSource
[] to ["names","health"]by backfillSource
empty to hhsby backfillSource
empty to 6988by backfillSource
2025-12-26 to 2025-05-07by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (Oregon DOJ), confirmed by Oregon DOJ. Record counts are as reported. Not legal advice.