CUSO Financial Services, LP Data Breach Notice (Oregon Attorney General)

The notice you received from CUSO Financial Services means that personal information belonging to you was included in an incident that occurred on December 19, 2023. The organisation filed its notification with the Oregon Department of Justice on October 28, 2024 — 314 days later.

314 days passed between the incident and the filing

That interval is the single most striking fact in the record. The breach happened in December 2023. Oregon residents learned about it through formal notification nearly ten and a half months afterward. The filing itself contains no discovery date, so it is not possible to say how long the information was accessible before CUSO became aware of the incident. What is known is the gap between the stated incident date and the date the state received the mandatory notice.

What the filing actually lists as exposed

The record names only one category: personal information. No passwords, no financial account numbers with authentication credentials, and no permanent government identifiers beyond what Oregon law requires to be disclosed in this format. Because the filing does not list Social Security numbers, driver’s licenses, or medical data as separate categories, those specific fields were not named as exposed in this notification.

This is important. The absence of those categories means the letter you received is unlikely to contain the worst-case combination of data that frequently drives long-term identity theft. No passwords were exposed, so there is no need to change any password connected to CUSO Financial Services.

What this exposure still enables

Even limited personal information retains value to fraudsters. Names combined with contact details and any associated account references can be used to attempt account takeover, tax refund fraud, or to build synthetic identities over time. The information cannot be revoked or reissued in the way a compromised credit card can. Once it has left the organisation’s control, it remains available for misuse indefinitely.

The people whose records were included in this filing — 75,116 in total — now carry an elevated risk of targeted fraud attempts that reference CUSO or affiliated financial advisory relationships. That risk does not expire when the news cycle moves on.

How to determine whether you were affected

CUSO Financial Services is required to notify affected individuals directly, usually by mail to the last known address. If you received a letter, your information was included. If you have not received any communication, it is likely you were not part of the group whose records were exposed. However, if you have moved since December 2023, a letter may have gone to an old address. In that case, contact CUSO Financial Services directly to confirm whether your records were involved.

The difference between what can and cannot be fixed

Because the filing does not list passwords or authentication credentials, your CUSO account itself is not at immediate risk of takeover through this breach. That is genuine good news. The exposure is narrower than many breach notifications that cross a reader’s desk.

Yet the personal information that was named cannot be changed. You cannot obtain a new name, a new date of birth, or a new history of your relationship with the firm. The realistic posture is therefore ongoing vigilance rather than one-time remediation. The data is now outside the organisation’s protection and will remain so.

Practical steps that address this specific exposure

• Place a fraud alert with the three major credit bureaus. This forces lenders to verify your identity before opening new accounts in your name and lasts for one year. It is the single most effective immediate step when personal information has left a financial services firm.
• Review every explanation of benefits and tax transcript for the next 24 months. Look for claims or filings you did not make. CUSO’s advisory clients often have linked investment and retirement accounts that can be targeted with forged change-of-address requests.
• Monitor your bank and brokerage accounts for unfamiliar ACH transfers or wire instructions. The combination of personal details and knowledge of your advisory relationship can be used to impersonate you to custodians.
• Consider freezing your credit reports. Unlike a fraud alert, a freeze stops new credit from being opened until you lift it. It is free and provides stronger protection if you rarely apply for new credit.
• File your taxes early each year. This reduces the window in which someone could file a fraudulent return using your personal information.

The 314-day gap between the December 2023 incident and the October 2024 filing is long by any standard. It does not change what you can control today. The letter in your hand or the confirmed absence of one remains the clearest indicator of whether your records were included. Focus on the concrete protections above rather than on what cannot be undone.