Oregon Zoo says 'unauthorized actor' caused data breach

PORTLAND, Ore. (KOIN) — The Oregon Zoo said it is in the process of notifying customers about a cybersecurity breach that may have caused customers' payment card information to be leaked.

The data breach occurred with the zoo's third-party vendor for online ticket sales. After the zoo noticed some "suspicious activity" with the service, they quickly shut down online sales and launched an investigation.

"We learned that an 'unauthorized actor' had redirected customer transactions from the third-party vendor that processes our online ticket purchases, potentially obtaining payment card information from Dec. 20 [2023] to June 26 [2024]," a spokesperson for the Oregon Zoo told KOIN 6 News. "We notified federal law enforcement, and rebuilt a new secure site for online ticket purchases. As a precaution, we also reviewed all transactions from this time period to identify anyone who might have been affected."

The Oregon Zoo said since the June 26 discovery of the breach, they've been in the process of notifying everyone who may have been affected, including offering them a free year of credit monitoring to those who want it, starting with letters sent out on Friday, Aug. 16.

According to a filing by the Oregon Zoo with the Maine Attorney General, 117,815 people may have been affected by the data breach, including 157 Maine residents. The number of Oregon residents potentially impacted by the breach is 77,234, a spokesperson for the Oregon Attorney General's Office confirmed to KOIN 6 News.

The personal information that may have been compromised includes the name, payment card number, CVV and expiration date, according to the Oregon Zoo.

The Oregon Zoo said it is sending out letters notifying potentially impacted customers. In a copy of the letter, the zoo outlined steps it would be taking to address the issue in the future.

“Maintaining the confidentiality, privacy and security of customers’ information is our priority. Our response to this event included initiating an investigation and notifying federal law enforcement. We are reviewing our policies and procedures to reduce the likelihood of similar events in the future. Additionally, we decommissioned the previous online ticketing website and rebuilt a new secure site for online ticket purchases. As an added precaution, we are offering credit monitoring and identity protection services through Cyberscout, a TransUnion company, for 12 months at no cost."

Oregon Zoo officials also encouraged customers to stay vigilant against identity theft and fraud by reviewing account statements, monitoring credit reports for suspicious activity or errors and reporting any suspicious charges to the institution that issued the payment card.