A former Hamilton Construction Co. employee has filed a proposed class-action lawsuit accusing the Springfield-based contractor of taking months longer than Oregon law allows to tell workers that their personal information, including Social Security numbers, had been exposed in a data breach. Scott Jenkins, a Veneta resident and former Hamilton employee, says the breach occurred around June 19, 2025, but he wasn't notified until November 12, 2025 — a gap of roughly 146 days, according to the complaint.
Jenkins filed suit on September 23, 2026, in Lane County Circuit Court, citing breach of implied contract and negligence, according to reporting by the Tacoma News Tribune, which noted the article originally appeared in the Register-Guard. The complaint argues that handing over personal information was a mandatory condition of employment at Hamilton, and that the company then failed to protect it. Jenkins is represented by attorneys with Olsen Barton LLC, a Lake Oswego-based firm. Attorney Dan Oliner has litigation and class-action experience.
A Timeline Well Past Oregon's 45-Day Window
Oregon's Consumer Information Protection Act, ORS 646A.604, requires businesses to notify affected residents of a security breach without unreasonable delay and no later than 45 days after discovery, while also filing a report with the state if more than 250 residents are impacted, according to the Oregon Department of Justice. The act was first passed in 2007 and updated as recently as 2019.
Hamilton didn't file its official breach disclosure with the Oregon Department of Justice until December 15, 2025 — 179 days after the breach allegedly occurred, per the complaint. The lawsuit also says Hamilton notified Washington state regulators around November 12, 2025, roughly a month before it reported to Oregon officials, laying out a notification timeline that varied by state. The breach ultimately affected 2,667 Oregon residents. Because more than 1,000 state residents required individual notice, Oregon law also required Hamilton to alert nationwide consumer credit reporting agencies, according to Insureon.
Allegations of Poor Network Security
Jenkins alleges Hamilton failed to monitor the networks housing employees' private information and failed to properly encrypt the data, leaving the company's security failures to place plaintiffs at risk of harm. He is asking the court to certify the case as a class action, and is seeking lifetime credit monitoring and identity theft insurance for victims, along with monetary relief. He has also demanded a jury trial.
The dispute over remediation is central to the case. Hamilton offered affected individuals 12 months of free credit monitoring, which the lawsuit contends is inadequate to mitigate what could be a lifetime of heightened identity theft risk. The complaint separately estimates that Hamilton generates approximately $60 million in annual revenue, a figure raised in the filing when evaluating the company's financial capacity to cover potential damages.
A Springfield Firm With a Regional Footprint
Hamilton Construction Co. is based in Springfield and works on civil construction projects involving bridges, highways and railroads. Founded in 1939, the company is a Western contractor with work in remote Alaska and on bridge, highway, railroad and structural-component projects, according to a company profile published on Handshake.
Legal experts say the case fits into a broader shift in how courts are treating workplace data breaches. Seton Hall University School of Law professor David Opderbeck notes a growing trend of courts finding that employers owe a legal duty of care to safeguard employee personal information, making employer motions to dismiss such lawsuits increasingly likely to fail. That trend has coincided with an 800% increase in construction-industry data breaches between 2019 and 2020; slower adoption of digitization was cited as one contributing factor, according to a Kroll study cited by ConstructConnect. Construction firms like Hamilton often hold large volumes of sensitive employee data, financial credentials, and government project records, making them attractive targets.
No trial date has been set, and Hamilton has not publicly responded to the specific allegations in the complaint. The case remains pending in Lane County Circuit Court as Jenkins seeks class certification on behalf of the thousands of other Oregonians whose information was exposed.
