Crossroads Trading Co., Inc. Data Breach Notice (Oregon Attorney General)

The February 15, 2025 breach at Crossroads Trading Co., Inc. exposed personal information belonging to 60,041 people. The company filed notice with the Oregon Department of Justice on March 25, 2025 — 38 days later. No passwords, financial data, or permanent government identifiers such as Social Security numbers were listed in the filing.

What This Exposure Actually Means for You

If you received a notification letter from Crossroads Trading Co., your name, address, and contact details are now in the hands of whoever accessed the compromised system. These pieces of information do not expire. They remain valuable for identity thieves who use them to build convincing profiles for account takeover attempts, phishing campaigns, or impersonation scams long after the initial breach is forgotten.

The filing does not state that any passwords were exposed. That is genuinely good news. You do not need to change any Crossroads password, and the company’s systems themselves are not at immediate risk of credential-based attacks stemming from this incident.

Because the record lists only “personal information” without further detail, the exact combination of data taken is not public. The company is required to notify each affected individual directly, usually by mail, with specifics about what applied to them. If you have not received such a letter, it is likely your records were not included. However, if you have moved since February 15, 2025, contact Crossroads Trading Co. directly to confirm your status.

How Thieves Use Basic Personal Details Years Later

Name plus address and phone number or email is enough to pass basic verification on many retail, loyalty, and service accounts. Thieves can attempt to reset passwords on other sites where you reused contact information, request replacement cards, or open new accounts that appear legitimate because the biographical details match public records.

Unlike a credit card number that can be canceled, these details cannot be reissued. Once they are loose, the risk is permanent. The 38-day gap between the incident and the filing does not tell us how long the data was accessible, only that notification occurred more than a month after the recorded breach date.

The Value of This Data on the Open Market

Personal information of this type retains resale value on data broker sites and underground marketplaces well beyond the initial news cycle. Crossroads Trading Co. also appears in people-search aggregator databases, meaning the same organization that held your records may already sell related information about consumers. This overlap increases the chance that fragments of your profile already exist elsewhere and can be combined with what was taken in February.

The scale — 60,041 individuals — makes this one of the larger retail-sector notifications filed in Oregon this year. The filing itself reveals nothing about how the breach occurred, whether the data was copied or simply viewed, or what security measures were in place.

What Remains Under Your Control

You cannot make the exposed personal information disappear, but you can limit what thieves can do with it. Focus on the accounts and relationships that rely on these same contact details. Monitor statements and confirmations from any retailer, bank, or service where you have used the same email, phone number, or mailing address associated with your Crossroads account.

Place a freeze on your credit reports so new accounts cannot be opened without your explicit permission. This single step blocks many common follow-on frauds that begin with basic personal data. Review your annual credit reports for unfamiliar inquiries or accounts. Consider enabling two-factor authentication everywhere it is offered, especially on email and financial services, using an authenticator app rather than SMS when possible.

Be especially wary of unsolicited calls, texts, or emails that reference your shopping history with Crossroads Trading Co. or ask you to “verify” contact information. These are classic signs of spear-phishing that leverage data from retail breaches.

Why the 38-Day Notification Window Matters

State law sets varying deadlines for breach notifications. The 38 days between February 15 and March 25 sits within many standard windows once an investigation begins. The filing provides no discovery date, so it is not possible to calculate how quickly the company identified the incident. What matters to you is that the official record now exists and the company must send individualized notices.

Absence of a letter after several weeks usually indicates you were not in the affected group of 60,041. Anyone who changed addresses after mid-February should reach out to the company to verify whether their records were involved.

This breach confirms that even retailers without access to credit cards or government IDs can still expose information that fuels identity-related crime for years. The data cannot be taken back. What you control now is how aggressively you monitor and lock down the places where that information is still used to authenticate you.