◆ Current and former patients of Las Vegas Cancer Center (LVCC) may have had their personal information exposed after a ransomware attack, the center said.^[1] Administrators confirmed that hackers accessed encrypted data on the center’s server over Labor Day weekend. The security breach was discovered on Sept. 7 when staff returned after the holiday. Although the organization’s server and computers were protected by a firewall and multiple malware defense systems, hackers may have been able to access patient names, addresses, dates of birth, Social Security numbers, medical records and insurance information as a result of the breach, according to the center. However, officials said that all patient data was stored in a proprietary format and likely was not usable by hackers. “LVCC does not believe that any data was copied or transferred from its server, and has received no ransom demand from the hackers to unlock data,” the center said in a statement. Since the center could not determine what records may have been accessed, administrators advised current and former patients to closely monitor their credit activity and insurance for suspicious activity.

◆ Oregon’s central administrative agency inadvertently released the COVID-19 vaccination status of more than 40,000 employees to two media outlets.^[2] A spreadsheet sent to The Oregonian and the Statesman Journal was supposed to contain the latest vaccination rates and vaccine exemption rates for each executive branch agency. Gov. Kate Brown (D) issued an executive order in August requiring all executive branch employees—along with individuals working in educational and health care settings—to be fully vaccinated by Oct. 18. But instead of sending the vaccine and rate information, an official at the Oregon Department of Administrative Services emailed a file containing vaccination status by employee name. Oregon House Republican Leader Christine Drazan called it a “significant breach of confidentiality,” and the Oregon State Police Officers Association said it had filed a grievance, and was “exploring other legal remedies.”