California Casualty Indemnity Exchange Data Breach Notice (Oregon Attorney General)

The filing from California Casualty Indemnity Exchange shows that personal information belonging to 6,416 people was exposed in an incident dated September 2, 2025. Oregon residents learned of it through a notification filed with the state on November 19, 2025 — 78 days later.

Personal information now sits outside the company’s control

If you received a letter from California Casualty, some of your personal information is now in unknown hands. The record lists personal information as the category exposed. No passwords, no financial account numbers, and no government identifiers that cannot be replaced were named in the filing.

That absence matters. Because no credentials were exposed, this incident does not require you to change any California Casualty password. The risk centers on the personal details that stay with you for life and can be used to impersonate you elsewhere.

What 78 days between incident and filing actually tells you

The gap between the recorded incident date of September 2 and the filing date of November 19 is the single clearest fact in the record. Regulators received the notice nearly eleven weeks after the company listed the breach as having occurred. Notification timelines vary by state law and by when an internal investigation closes, so the filing itself does not label this interval as unusual or acceptable. It simply records both dates.

For anyone whose information was included, those 78 days represent the minimum time between the company’s chosen incident marker and when Oregon was formally told. The record contains no discovery date, so it is not possible to calculate how long the data may have been accessible before the company marked the incident.

The letter is the only reliable way to know if you are affected

California Casualty is required to notify affected individuals directly, usually by mail. If you have not received a letter, your information was most likely not part of the 6,416 records named in this filing. However, if you have moved since September 2, 2025, a letter may have gone to an old address. In that case, contact the company directly to confirm whether your records were involved.

What personal information exposure actually enables

Names combined with addresses, dates of birth, or policy details create durable building blocks for identity theft. Unlike a credit card that can be canceled, these pieces of information cannot be reissued. Fraudsters can use them to open accounts, file false tax returns, or apply for benefits in your name years from now.

The filing does not state that every one of the 6,416 individuals had the same fields exposed. Some records may have contained only basic contact details while others held richer policy information. Your own notification letter is the only document that lists exactly what applied to you.

Why the absence of certain data fields is genuinely good news

No passwords were exposed. No Social Security numbers or driver’s license numbers appear in the listed categories. That removes the most immediate account takeover risk and eliminates the need for urgent password resets on this policy. The exposure is narrower than many breach notifications that list multiple high-value identifiers.

Yet the information that was exposed still carries long-term value on the black market precisely because it cannot be changed. The people whose records were included now face an elevated risk of impersonation fraud that will not expire when a new card arrives in the mail.

Concrete steps that address this specific exposure

• Place a fraud alert with the three major credit bureaus. A fraud alert makes lenders verify your identity before opening new accounts and lasts for one year. It is the fastest way to raise the bar on new-account fraud built from stolen personal details.
• Review your Explanation of Benefits statements from California Casualty and any other insurer. Look for claims you did not file. Policy information can be used to create fake medical claims or to support other fraud schemes.
• Monitor your tax account with the IRS and your state revenue department. Identity thieves sometimes file returns using personal information taken from insurance records. Early detection prevents delayed refunds or unexpected tax bills.
• Freeze your credit if you do not expect to apply for new loans or insurance soon. A freeze stops new accounts from being opened in your name and is more protective than a fraud alert. You can lift it temporarily when needed.
• Keep the notification letter and file a copy of this filing. Should fraudulent activity appear later, these documents establish when you first learned of the exposure and help speed up disputes with banks, insurers, or government agencies.

The record is limited by design. It tells us which category of information was involved, how many Oregon residents were named, and the exact dates attached to the incident and the filing. Everything else — the method used, the length of any unauthorized access, and the precise fields per person — remains undisclosed. What matters most to you is whether your own letter arrived and what it listed. That single document, not this filing, determines your next actions.