CareOregon Data Breach 2025: 5,473 Medicaid Members Affected · Unauthorized Access · OR. Filed With HHS OCR. What To Do.

CareOregon, the Medicaid managed-care organization that administers benefits for roughly half a million Oregon Health Plan members, notified 5,473 individuals in December 2025 that their personal health information had been viewed without authorization. The plan learned of the unauthorized access on October 27, 2025 and issued formal notices on December 26, 2025, jointly with Health Share of Oregon, the coordinated care organization through which CareOregon delivers Medicaid benefits in the Portland metro area.

In its notice, CareOregon told members the information may have been used to file fake insurance claims. The plan said it was unable to determine whether any specific member’s information had in fact been misused.

Timeline

• October 27, 2025 — CareOregon and Health Share of Oregon learn that one or more individuals viewed member information without permission.
• December 22, 2025 — CareOregon publishes a member update announcing that letters will go out to affected members.
• December 26, 2025 — Formal notice of data event issued; this is the date associated with the HHS OCR breach filing.

What was exposed

According to CareOregon’s notice and corroborating press coverage, the information viewed and potentially obtained was limited to:

• First and last name
• Date of birth
• Health plan information
• Medicaid ID number
• Medicare ID number, where applicable
• Primary care provider office

CareOregon stated that Social Security numbers and financial information were not accessed.

A sensitive population: Medicaid members

CareOregon is the largest Medicaid managed-care plan in Oregon and one of three risk-bearing entities under Health Share of Oregon, which coordinates Oregon Health Plan benefits for residents of Multnomah, Washington, and Clackamas counties. Members are, by definition, low-income, and many depend on the plan for primary care, behavioral health, and dental coverage.

A breach exposing Medicaid ID numbers carries a specific risk profile that differs from a typical commercial-insurance breach. Medicaid IDs can be used to bill fraudulent claims against state Medicaid programs, and members generally lack the ability to detect that misuse through routine financial monitoring. The plan’s own notice acknowledged that the information could be used to create fake insurance claims.

Credit monitoring and fraud assistance

CareOregon’s public member update and notice of data event do not announce complimentary credit-monitoring services. The plan directs members to its customer service line at 503-334-4134 to confirm whether they were among those affected and to update mailing addresses. If your individual notification letter offers monitoring or remediation, the terms in the letter govern.

Class action and litigation status

At least one plaintiffs’ firm, Cole & Van Note, has publicly announced a class-action investigation tied to the CareOregon breach. As of the date of this page, no filed complaint has been publicly identified. We will update this page if and when a complaint is filed and docket information becomes available.

What to do if you may be affected

• Check your mail. Notification letters were sent to the address CareOregon has on file. If your address has changed or you are unable to receive mail, call Health Share/CareOregon Customer Service at 503-334-4134 to confirm your status and update your address.
• Review Medicaid Explanation of Benefits or claims activity. Because the exposed information could be used to file fraudulent insurance claims, watch for services or providers you do not recognize on any Medicaid claim summaries you receive. Report suspected Medicaid fraud to the Oregon Department of Human Services fraud hotline.
• Freeze your credit anyway. Although Social Security numbers were not reported as part of this breach, a credit freeze with the three nationwide consumer reporting agencies is free, takes about ten minutes per bureau, and remains the single highest-leverage step against identity theft if your information was exposed in any other incident.
• Be alert to phishing. Threat actors sometimes follow public breach notices with phone calls or texts impersonating the breached organization. CareOregon will not ask you for your Social Security number, full date of birth, or financial account information to “verify” your breach status.
• Bookmark this page. We update it as new information becomes publicly available, including any class-action filings, OCR portal updates, or supplemental notices.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of HIPAA breach filings.
• CareOregon — Members to be notified of recent data breach (December 22, 2025) — the plan’s own member update.
• CareOregon — Notice of Data Event (PDF, December 26, 2025) — the formal substitute notice.
• HIPAA Journal — CareOregon and Health Share of Oregon Warn of Potential Insurance Fraud After Data Breach — corroborating trade-press summary, including affected count of 5,473.
• DataBreaches.net — Health Share of Oregon and CareOregon notify members of data breach — independent breach-tracking summary.
• Paubox — CareOregon notifies members after personal health information breach — secondary summary, including reference to a prior 2025 mismailing incident.
• Cole & Van Note — CareOregon Data Breach Investigation — class-action investigation page.