The Oregon Health Authority said in early August 2023 that personal and health information belonging to roughly 1.7 million Oregon Health Plan members had been exposed in a breach at one of its contractors.
The contractor, Performance Health Technology, known as PH Tech, processes claims for the state Medicaid program and for coordinated care organizations including AllCare CCO, Health Share of Oregon, Umpqua Health and Yamhill Community Care. Attackers reached its data through the MOVEit Transfer file sharing product, exploiting the same zero day flaw the Clop group used against hundreds of organizations from late May 2023.
PH Tech said the data was taken on or about May 30 and that Progress Software notified it of the vulnerability on June 2. The company disabled MOVEit, applied the patch and rebuilt access controls.
Exposed records varied by individual but could include names, dates of birth, Social Security numbers, mailing and email addresses, health plan and member identification numbers, and claims, authorization, diagnosis and procedure information. Alongside the Oregon Health Plan members, PH Tech reported about 47,800 further individuals affected through other clients.
PH Tech notified affected people by mail and offered complimentary credit monitoring. Oregon officials urged all Oregon Health Plan members to obtain free credit reports and monitor their accounts.