Veterans Affairs Department officials say personal information from more than 1,500 Portland patients was mistakenly posted on a Web site.
Portland (Ore.) VA spokesman Mike McAleer says the breach involved patients who had stayed in local lodging at the VA's expense while undergoing treatment at the 149-bed VA Medical Center, Portland.
No medical information was disclosed, but some Social Security numbers were.
VA officials deleted the information when they learned of the lapse, but McAleer did not know how long it had been publicly available.
The Portland VA began notifying affected patients late last month. The VA is offering them free credit monitoring and fraud alert services. The breach also involved patient information from other VA hospitals around the country.