Oregon Privacy Enforcement Cases

Why the action was brought

Blackbaud’s deficient data security and response to a 2020 ransomware event exposed personal and protected health information, including contact, demographic, Social Security, driver’s-license, financial, employment, wealth, donation, and health data. It allegedly failed to implement reasonable security, remediate known gaps, and provide timely, complete, accurate breach information, delaying or preventing consumer notification.

Why the action was brought

Premera failed to address known cybersecurity vulnerabilities and maintain adequate administrative, physical, and technical safeguards. A spear-phishing email installed malware, allowing a hacker nearly a year of unrestricted access to personal and protected health information, including names, addresses, Social Security numbers, health information, member numbers, bank details, and email addresses of millions.

Why the action was brought

In July 2019, a scammer accessed an Avalon employee’s email after a phishing scam. The breach exposed names, addresses, Social Security numbers, dates of birth, driver’s license numbers, medical treatment information, and limited financial information of 14,500 employees and patients. Avalon notified affected individuals approximately 10 months later, exceeding Oregon’s 45-day requirement.