If you’re one of the 1.7 million Oregonians whose information was potentially compromised by the recent Equifax data breach, don’t expect to get a letter in the mail telling you about it.
That's because under a 2007 state law, companies that experience electronic security breaches don't have to personally inform victims if the cost of making such notifications would exceed $250,000 or if the number of people affected exceeds 350,000.
It’s part of a much larger bill that was known as the “Oregon Consumer Identity Theft Protection Act.”
In a state-mandated notification to the Oregon Department of Justice on Sept. 7, Equifax stated that 1,721,725 Oregonians were "potentially impacted" by the data breach, which occurred over a period of several months earlier this year.
Related: 143 Million Americans Are Victims Of Equifax Cyberattack
That’s nearly half of the state’s population. Equifax said roughly 143 million U.S. consumers were affected overall.
The company, which collects information on consumer credit history, said its systems were “exploited” by hackers who were able to access names, Social Security numbers, birth dates, addresses and in some cases driver’s license numbers.
The breach was the subject of a hearing at the Oregon Capitol on Tuesday.
Aaron Knott, the Legislative Director for the Oregon Department of Justice, told members of the Oregon House and Senate Judiciary committees that some of them were probably affected.
“Look to the person to your right, look to the person to your left,” Knott said. “Probably at least half, if not more of you, have been impacted by this. This is an incredibly significant breach.”
Equifax isn’t completely off the hook when it comes to letting Oregonians know about the issue.
The 2007 law requires companies that experience massive data breaches to post a notice on their website, and to notify “major statewide television and newspaper media.”
The law also requires companies to allow potential victims of a data breach to place a freeze on their credit history. According to the Oregon Department of Justice, Equifax is allowing Oregonians to do this for free until Nov. 21.