The Oregon Capitol in Salem.
John Rosman / OPB
A state employee jeopardized the personal information of tens of thousands of Oregonians last month, after transferring sensitive tax records to a personal online storage account.
While offering scant details, the Oregon Department of Revenue said Friday that the names, addresses and Social Security numbers of roughly 36,000 taxpayers were improperly transferred in the breach — a violation of state policy and potentially a criminal offense. The Department of Revenue says there's no indication any of the data found its way into the wrong hands.
"By policy and by law, we can't have employees move confidential taxpayer information," Department of Revenue spokesman Derrick Gasperini told OPB. "For us, the good news is that our existing procedures were sound. Our detection systems worked."
Gasperini wouldn't identify the employee in question, citing due process concerns, but said he works in finance and accounting in the Department of Revenue's headquarters in Salem.
Officials also won't comment on the employee's potential reasons for transferring tens of thousands of records to a personal storage space. The data in question involved taxpayers who'd written bounced checks to the state, Gasperini said. The employee is on administrative leave and faces "anything from a written warning to termination and criminal penalty."
The incident occurred on Feb. 21, officials say and was detected by routine security checks two days later. Gasperini said the department moved swiftly to reclaim the records.
"We were able to contain the incident," he said. "We understand public trust is absolutely critical."
Even though officials don't believe any records leaked out beyond the initial file transfer, the state is still offering help. The Department of Revenue has hired a company called ID Experts to contact each person potentially affected to offer identity theft recovery services.
As for the employee who mishandled the data, Gasperini expects the state will share more details as early as April 4. He would not comment on whether the Oregon State Police are investigating the matter as a crime.