Apro, LLC d/b/a United Pacific Data Breach Notice (Oregon Attorney General)

The filing from Apro, LLC doing business as United Pacific shows that personal information belonging to 11,986 people was exposed on May 23, 2025. The organisation did not notify Oregon authorities until December 29, 2025 — an interval of 220 days, or roughly seven months.

If you received a letter from United Pacific, your records were part of this incident. The company is required to notify affected individuals directly, usually by mail. Absence of a letter most often means you were not in the affected group, but anyone who has moved since May 23, 2025 should contact the company directly to confirm their status.

Personal Information That Cannot Be Replaced

The record lists personal information as the category exposed. In practice this typically includes name, address, date of birth, and Social Security number. These details do not expire. Once they leave an organisation’s control they remain usable for identity theft and fraud for years.

Unlike a credit card or password, a Social Security number cannot be reissued on demand. The same is true for an exact date of birth paired with your name. These pieces of information give someone a foundation to open accounts, file fraudulent tax returns, or apply for government benefits in your name.

What the Seven-Month Gap Changes for You

A 220-day period between the incident and the filing is long enough to matter. During that time the exposed information could have been used, sold, or stored without your knowledge. The delay does not prove negligence — state rules and ongoing investigations affect notification deadlines — but it does mean you should treat the risk as current rather than historical.

Because no passwords or login credentials were exposed, this incident does not put your United Pacific account itself at direct risk of takeover. That is genuine good news. The threat lies in the biographic and government identifiers, not in someone logging into your customer portal.

How Criminals Use This Exact Combination

A name plus Social Security number is one of the highest-value datasets in underground markets. It allows synthetic identity fraud, tax refund theft, and medical identity misuse. When an address and date of birth are also available, the success rate of these schemes rises sharply.

Even if you have never been a victim before, these records can be combined with information from earlier breaches. Identity thieves rarely rely on a single source. The 11,986 affected records become building blocks for larger, more convincing fraud attempts that may surface months or years from now.

What Remains Under Your Control

You cannot change the fact that the information was exposed. You can control how closely you monitor the downstream consequences. The most effective steps focus on early detection rather than prevention of something that has already occurred.

Place a fraud alert or credit freeze with the three major bureaus so new accounts cannot be opened without your explicit permission. Review your tax transcripts from the IRS each year before filing to ensure no one has used your Social Security number to claim refunds. Monitor Explanation of Benefits statements from health insurers even if you did not receive care, because medical identity theft can appear as phantom claims.

These actions do not undo the breach. They limit how long an attacker can profit from your specific records before being noticed.

The Difference Between This Breach and Account Compromise

Many people assume every breach puts their login at risk. Here the record shows no credential exposure. Changing your United Pacific password would be unnecessary work that does not address the actual data that left the company.

The permanent risk is the identity information itself. Focus monitoring and protective steps on Social Security number misuse, new-account fraud, and tax-related identity theft. Those are the realistic consequences supported by the filing.

United Pacific has an obligation to provide additional details to anyone it notified. If your letter listed specific categories beyond the general “personal information” description in the state filing, use those details to fine-tune which accounts and agencies you contact. The letter remains the single best indicator of exactly what applied to you.