Snake River Correctional Institution and Oregon Department of Corrections: Data breach at Snake River Correctional Institution affects thousands of records, former employee terminated

Data Breach at Snake River Correctional Institution Exposes Thousands of Records

The Oregon Department of Corrections (ODOC) disclosed a significant data breach at Snake River Correctional Institution (SRCI), located outside Ontario, Oregon. The incident, discovered on January 5, involved a former employee who improperly accessed and extracted 33,000 files containing over 7.5 GB of sensitive data between July 7, 2025, and January 2026.

The compromised records include personal information belonging to employees, vendors, visitors, and inmates associated with the facility. ODOC is collaborating with forensic investigators to determine the full scope of affected individuals. The former employee responsible for the breach has since been terminated.

SRCI, which relies on Ontario’s water supply despite its location outside city limits, has not disclosed specific details about the types of data exposed. The breach underscores ongoing risks to sensitive institutional data in correctional facilities. No further updates on remediation efforts or potential legal consequences have been released.

Source: https://www.argusobserver.com/free_access/data-breach-at-snake-river-correctional-institution-affects-thousands-of-records-former-employee-terminated/article_b764e50b-203d-40c6-825d-93cd525ffd61.html

Oregon Department of Corrections cybersecurity rating report: https://www.rankiteo.com/company/oregon-department-of-corrections

"id": "ORE1780107920",
"linkid": "oregon-department-of-corrections",
"type": "Breach",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Employees, vendors, visitors, '
                                              'and inmates',
                        'industry': 'Government (Corrections)',
                        'location': 'Ontario, Oregon, USA',
                        'name': 'Snake River Correctional Institution (SRCI)',
                        'type': 'Correctional Facility'}],
 'attack_vector': 'Insider Threat',
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': '33,000 files',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Personal information'},
 'date_detected': '2026-01-05',
 'description': 'The Oregon Department of Corrections (ODOC) disclosed a '
                'significant data breach at Snake River Correctional '
                'Institution (SRCI), located outside Ontario, Oregon. The '
                'incident involved a former employee who improperly accessed '
                'and extracted 33,000 files containing over 7.5 GB of '
                'sensitive data. The compromised records include personal '
                'information belonging to employees, vendors, visitors, and '
                'inmates associated with the facility.',
 'impact': {'data_compromised': '33,000 files (7.5 GB of sensitive data)',
            'identity_theft_risk': 'High'},
 'investigation_status': 'Ongoing',
 'post_incident_analysis': {'root_causes': 'Improper access by former '
                                           'employee'},
 'references': [{'source': 'ODOC Disclosure'}],
 'response': {'containment_measures': 'Termination of the former employee',
              'third_party_assistance': 'Forensic investigators'},
 'threat_actor': 'Former Employee',
 'title': 'Data Breach at Snake River Correctional Institution Exposes '
          'Thousands of Records',
 'type': 'Data Breach'}