OLCC Discloses Employee Data Breach That Warranted Criminal Investigation

When it rains on the Oregon Liquor and Cannabis Commission, it pours.

The agency is already reeling from Gov. Tina Kotek’s recent firing of OLCC director Steve Marks, the resignation of commission chair Paul Rosenbaum, and a pending criminal investigation into the diversion of rare bourbon. Then, on Feb. 21, the agency notified employees of a data breach serious enough to warrant a criminal investigation.

The OLCC initially discovered the breach Aug. 1. The notice to employees says an OLCC staffer improperly exported private information, including, in some cases, Social Security numbers and driver’s license numbers, to the employee’s personal email account. It is unclear why.

The notice to employees says there is no evidence the personal information has been misused and there was “no malicious intent.” Nonetheless, the OLCC is offering employees identity theft protection and recovery services, including a $1 million insurance reimbursement policy.

OLCC spokesman Mark Pettinger says the breach affected some retirees and job applicants but fewer than 500 people in total. The criminal investigation ended without charges, but a personnel investigation into the matter continues.