Calton & Associates Data Breach Notice (Oregon Attorney General)

The March 28, 2025 breach at Calton & Associates left personal information belonging to 926 people exposed. The organisation filed its notification with the Oregon Department of Justice on June 30, 2025 — 94 days later.

What the 94-day gap means for you

That interval is the single most concrete fact in the public record. State law sets different clocks depending on when an investigation concludes and whether law enforcement asks for delay. The filing itself does not explain the reasons. What matters is the outcome: if you are one of the 926 Oregon residents named, the organisation was required to send you a direct notice, almost always by mail to the address it held on file at the time of the incident.

Absence of a letter usually means your records were not part of the exposed group. However, anyone who has moved since March 28, 2025 should contact Calton & Associates directly to confirm whether their information was included.

The only data category named in the filing

The record lists one category: personal information. No passwords, no financial account numbers, no medical details, and no government identifiers such as Social Security numbers appear in the disclosed fields. This is genuine good news. The exposure does not create immediate credential risk and does not require you to change any passwords for Calton & Associates accounts.

Because the filing uses the broad term “personal information,” the exact fields that applied to any single individual are not public. Your own notification letter, if you received one, will list the specific elements that concerned you.

What permanent risk actually remains

Personal information in this context most often includes name combined with date of birth, address history, or other biographical details. Unlike a credit card, these cannot be cancelled or reissued. Once exposed they retain value for identity thieves who build synthetic profiles or attempt account takeover at other organisations where you already have relationships.

The 926 affected individuals therefore face a long-term but narrow risk: opportunistic fraud rather than immediate mass identity theft. The absence of Social Security numbers or financial account data sharply reduces the severity compared with many breaches that reach the Oregon Attorney General’s list.

Why the scale of 926 people matters

Calton & Associates is a relatively small advisory firm. The fact that 926 Oregon clients or former clients were included represents a meaningful fraction of its regional population. That number alone tells you the breach touched a substantial portion of the people the firm served in this state.

How to determine whether you are affected

The organisation is legally required to notify every impacted Oregon resident directly. Watch your mail for a letter from Calton & Associates postmarked after June 30, 2025. If you have changed addresses since March 28, 2025, the letter may have gone to an old address. In that case, call the firm and ask them to confirm your status against the breach list.

Do not rely on email notifications alone; the official filing and standard practice in Oregon point to mailed notice as the primary channel.

What this exposure actually enables

With only personal information exposed, the realistic threats are targeted phishing, imposter calls pretending to be from the firm, and attempts to use your name and biographical details to open new accounts elsewhere. These attacks succeed more often when the attacker already knows you had a relationship with Calton & Associates.

The good news is that none of the high-value, non-revocable identifiers that enable large-scale tax fraud or government-benefit theft were listed in the filing.

Practical steps that address this specific exposure

• Place a fraud alert with the three major credit bureaus. A 90-day alert is free, requires only one phone call, and forces lenders to verify your identity before opening new accounts in your name.
• Review your credit reports now and again in 30 days. Look for accounts or inquiries you do not recognise. The exposure of personal information makes new-application fraud the primary remaining vector.
• Tighten authentication on every financial and government account you hold. Enable multifactor authentication everywhere it is offered, especially on retirement accounts, banks, and tax portals where biographical details alone can sometimes trigger password resets.
• Treat any unsolicited contact claiming to be from Calton & Associates with suspicion. Call the firm using a number you look up yourself rather than one provided in the message.
• Keep the notification letter. It contains the exact list of data types that applied to you and the contact information for any remediation the firm is offering. Store it with your tax records.

The record is narrow but clear. No credentials were lost. No permanent government identifiers were named. The 94-day notification window and the 926 affected Oregon residents are the measurable facts. Everything else — motive, method, exact fields per person — remains outside the public filing. Your own letter is the only document that can tell you with certainty whether you were among the 926.