CareOregon Data Breach Exposes Personal Information of Over 5,000 Medicaid Members CareOregon, Oregon’s largest Medicaid insurer serving approximately 500,000 low-income residents, disclosed a data breach affecting 5,473 members in late December 2025 two months after the incident was discovered. The breach, which occurred between late May and October 2025, involved unauthorized access to sensitive personal information, including names, dates of birth, Medicaid and Medicare numbers, health plan details, and primary care provider information. Social Security numbers were not compromised. The breach was detected on October 17, 2025, though the exact cause whether internal or external remains unclear. CareOregon notified affected members on December 26, warning that the exposed data could be used to file fraudulent insurance claims. While the organization stated there was no evidence of misuse, it advised members to disregard any unexpected bills from CareOregon or its affiliates, including Health Share of Oregon, Jackson Care Connect, and Columbia Pacific. The compromised data was limited to health-related information, reducing the risk of financial account fraud but still posing a threat to insurance fraud. CareOregon reported the incident to law enforcement and implemented corrective measures, including system fixes, access restrictions, and staff retraining. Affected members may receive letters listing health services they should have received and are encouraged to verify their records. The breach adds to a growing trend of healthcare sector cyber incidents, with over 57 million individuals affected by similar breaches in 2025 alone, according to the HIPAA Journal.

The personal information of some of the past and current members of CareOregon Advantage was accidentally disclosed in an email sent to a contracted consultant. The information included member name, ID number (Medicare and in some cases Medicaid), and date of birth of 0,467 past and current members. CareOregon notified the impacted individuals of the data breach and alerted them.