Oregon law requires a business or state agency to notify any Oregon consumer whose personal information, as defined, was subject to a breach of security. A breach of security is the unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information that an entity maintains. (You can read the law, the Oregon Consumer Information Protection Act, here: Oregon Revised Statutes 646A.600-646A.628 and as updated by Senate Bill 1551 (2018)).

The law also requires that a sample copy of a breach notice sent to more than 250 Oregon consumers must also be provided to the Oregon Attorney General. Below is a list of organizations that sent a notice to the Attorney General. (Note that in some cases the organization that sent the notice is not the one that experienced the breach. For example, a bank may notify of a credit card number breach that occurred not at the bank, but at a merchant.)

You can search by the name of the organization that sent the notice, or simply scroll through the list. You can obtain additional information about the breach by clicking on the name of the organization in the list.