Benworth Capital Partners Data Breach Notice (Oregon Attorney General)

The filing from Benworth Capital Partners shows that personal information belonging to 943 people was exposed in an incident on May 23, 2025. The organisation submitted its notification to the Oregon Department of Justice on September 16, 2025 — an interval of 116 days, or roughly 3.8 months.

The gap between the incident and the notification is the most immediate fact

That 116-day period stands out because it is long enough to matter. The record does not explain what occurred between those two dates, and it is not required to. What matters to you is that the breach happened in May and the formal notice reached state regulators only in mid-September. Anyone whose information was included should assume the exposure has existed for months.

What personal information actually enables

The filing lists only one broad category: personal information. No passwords, no financial account numbers, no Social Security numbers, and no government identifiers were named in the exposed categories. This is genuinely good news. Without those persistent identifiers, the immediate risk of new account fraud or tax-related identity theft is lower than in many breaches.

Still, the exposed personal information can be valuable to attackers when combined with data from other sources. Names, addresses, dates of birth, phone numbers, or email addresses — even if not explicitly listed — often fall under this umbrella and can support phishing, social engineering, or impersonation attempts. The absence of the most dangerous fields does not eliminate risk; it simply narrows it.

Why the letter is the only reliable way to know if you are affected

Benworth Capital Partners is required to notify affected individuals directly, usually by mail to the last known address on file. If you have not received a letter, it is likely your information was not part of the 943 records included in this incident. However, if you have moved since May 23, 2025, a letter may have gone to an old address. In that case, contact the organisation directly to confirm whether your records were involved.

The risks that remain permanent

Personal information does not expire. Once it has left the organisation’s control, it can circulate indefinitely. Even without Social Security numbers or financial details in this specific filing, the data can still be used to make you a more convincing target for scams that appear tailored to your life. Criminals rarely rely on a single breach. They combine records from multiple incidents until they have enough to pass basic verification questions or to craft believable phishing messages.

Because no passwords were exposed, there is no need to change any credentials for Benworth Capital Partners accounts. Doing so would be unnecessary work. The real ongoing concern is how this personal information might be leveraged in the future, not whether someone can log into your account today.

What this means for your daily decisions

Expect an increase in unsolicited calls, texts, and emails that reference your relationship with Benworth Capital Partners. Scammers often use breach data to add credibility to their stories. Treat any communication that creates urgency around money, taxes, or account access with skepticism, even if it appears to come from a familiar company.

The fact that only personal information was named also means the breach is unlikely to trigger the strongest credit monitoring or identity theft insurance offers that accompany exposures of Social Security numbers. That does not mean you should ignore it. It means your protection efforts should focus on vigilance rather than formal freezes or paid services unless you have other reasons for concern.

Concrete actions that address this specific exposure

• Mark your calendar for extra scrutiny on tax filings next year. Even without a Social Security number listed here, personal details can help fraudsters attempt to file returns in your name. Review your IRS account online regularly starting in January.
• Treat any Benworth-related communication as potentially fraudulent until verified. Call the organisation using a number from their official website, not from the letter or email, before sharing any additional information.
• Review your credit reports once in the next 30 days. Look for accounts you do not recognize. While this breach did not expose financial data, the personal information can still support identity theft when paired with records from elsewhere.
• Update your contact information with Benworth Capital Partners if you have moved since May 2025. This ensures any future notices reach you and reduces the chance that important mail is lost.
• Be cautious about sharing personal details in response to unsolicited contact. If someone already has some of your information from this incident, they will use it to lower your defenses. Verify every request independently.

The 943 people named in this filing now share a common reality: their personal information has been outside Benworth Capital Partners’ control since at least May. The long notification delay makes it realistic to assume the data has had time to travel. Yet the limited categories disclosed mean the worst-case scenarios involving government identifiers or account credentials do not apply here. That distinction matters. It lets you focus your attention on realistic risks instead of treating every breach as equally catastrophic.