iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The Oregon Zoo said an unauthorized actor redirected transactions in its online ticketing service, potentially exposing payment-card information for people who bought tickets between December 20, 2023, and June 26, 2024. The often-cited figure of nearly 118,000 refers to a contemporaneous estimate of people across multiple states—not a confirmed final total. If you received a notice, check its guidance and contact your card issuer about any suspicious charges.
What happened in the Oregon Zoo ticketing breach?
The Zoo became aware of suspicious activity in its online ticketing service on June 26, 2024. Its investigation determined on July 22, 2024, that an unauthorized actor had redirected customers’ transactions from the third-party vendor that processed online ticket purchases. The Zoo did not name the vendor in its filing.
The incident involved the online ticketing service and transactions during the period from December 20, 2023, through June 26, 2024. The filing says the Zoo decommissioned the site after discovering the activity, investigated, reviewed transactions to identify people whose card information might have been affected, and notified federal law enforcement. It does not establish that the Zoo’s current ticketing service uses the same system. Read the Zoo’s breach filing.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What information may have been exposed?
For people identified as potentially affected, the information that could have been obtained was:
#1 Best Overall
- Name
- Payment-card number
- Card verification value (CVV)
- Card expiration date
The filing says Social Security numbers were not affected. It describes card information as potentially exposed; it does not say that information was definitively taken for every person in the affected transaction period.
How many people were affected?
The figures reported refer to different scopes and should not be treated as interchangeable:
| Figure | What it represents | Source |
|---|---|---|
| 22,901 | Washington residents listed in the state’s posted notice | Washington State Office of the Attorney General, 2024 |
| Close to 118,000 | Approximate number of people across multiple states, as reported from breach notices | Oregon Public Broadcasting, August 21, 2024 |
The nearly 118,000 figure is a contemporaneous multi-state estimate, not a complete final state-by-state accounting established by the available notices and reporting. The Washington count is not the national total.
What should you do if you received a notice?
1. Check the notice and the purchase dates
Use the notice to confirm whether the Zoo identified you as potentially affected. The transaction period identified in the filing was December 20, 2023, through June 26, 2024. A purchase outside that period is not included in the identified window, but follow any instructions in a notice you actually received.
2. Review your card account and contact the issuer
Look for unfamiliar transactions and report suspicious charges to the bank or card issuer using the contact information on your card or statement. Ask the issuer whether it recommends replacing the card; that decision depends on your account and the issuer’s procedures.
3. Consider credit-file protections if appropriate
The Zoo’s filing says its guidance included fraud alerts, credit freezes, free credit reports, and reporting identity theft or fraud. These address credit-file risks and are distinct from disputing a card transaction. Choose the measures that fit your circumstances, especially if you see evidence of identity theft.
4. Check whether the historical monitoring offer applies to you
The filing says the Zoo offered one year of credit monitoring at no cost to people whose information was potentially affected. That was a response described in the incident notice; current enrollment availability or eligibility is not established here. Do not assume the offer remains open.
Free tools Windows power users keep installed
One-click scans. No signup required.
What did the Zoo say about losses and its ticketing site?
In its August 21, 2024 report, OPB quoted Zoo spokesperson Hova Najarian as saying: “We learned that an ‘unauthorized actor’ had redirected customer transactions from the third-party vendor that processes our online ticket purchases, potentially obtaining payment card information,” she said in an email to OPB. OPB also reported that the Zoo had decommissioned its previous ticketing site and constructed a new one. Najarian said no customers had reported losing money as of that report; that statement describes the position on August 21, 2024, not later outcomes.
The Zoo’s current ticketing notice says visitors should reserve online in advance, tickets are emailed, sales are final, and visitors should watch for ticketing scams. Those current service details do not show that the present ticketing system is connected to the system involved in the 2024 incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Oregon breach-notification rules
Oregon DOJ says Oregon law generally requires notifying affected consumers within 45 days of discovering a breach. For incidents affecting more than 250 Oregon consumers, the business must also submit a report and sample notice to DOJ within 45 days. This is general statutory guidance, not a finding about compliance in the Zoo incident. See Oregon DOJ’s data-breach guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
