Dept. of Revenue Security Event, March 26

The Oregon Department of Revenue has detected a security incident that involved approximately 36,000 individuals with records at the department. The facts of the incident are summarized below, along with protective measures the department has taken since discovering the incident. The potentially impacted information from the files included data such as names, addresses, and Social Security numbers. Because the Department of Revenue takes privacy and the confidentiality of taxpayer information seriously, it has strong information technology security processes in place, which enabled the department to quickly detect and contain the incident. The department has no indication that any personal information has been accessed or viewed by an unauthorized person, or used inappropriately. However, it is notifying the public as a precautionary measure. What happened? On February 21, 2018, a Department of Revenue employee uploaded work files to a personal cloud Storage account. Department of Revenue’s information security staff identified the upload through routine log reviews. When the incident was detected, the employee’s computer was seized and all network accesses and credentials were immediately disabled. The employee was duty stationed at home and placed on paid administrative leave pending conclusion of a conduct investigation. Department staff immediately launched a security investigation to determine the scope of the incident and the specifics of the information involved. Over the next several days, all files were deleted from the personal account. No evidence exists indicating the information was viewed or accessed by anyone other than department staff. While all data was successfully retrieved, it took time to thoroughly review the information involved and determine the number of potentially impacted individuals, as there were many duplicate records. What is the Department of Revenue doing? The security and confidentiality of personal information is critical to the Department of Revenue. While there is no indication that any personal information has been accessed by an unauthorized person or used inappropriately, as an added precaution the department is providing identity theft recovery services for potentially impacted individuals. A vendor, ID Experts, will send individual notices to the potentially impacted individuals with instructions on how to register for the service. The department is also adding the potentially impacted information into their identity theft risk file. Once added to this file, additional identity validation may be required when filing an Oregon personal income tax return. The department shares this file securely with numerous states’ tax departments to help prevent the information from being used to fraudulently file returns in other states. Need more information? For more information about protecting your identity, visit www.oregon.gov/dor and look under “Popular Topics.”