David’s Bridal Data Breach Notice (Oregon Attorney General)

The data breach at David’s Bridal that occurred on January 20, 2024, and was filed with Oregon authorities on September 13, 2024 — an interval of 237 days — has placed the personal information of 46,165 people at risk. If you received a notification from the company, your records were among those involved.

The 237-day gap between incident and notification

The filing establishes two clear dates: the incident itself on January 20, 2024, and the notification to the Oregon Department of Justice on September 13, 2024. That span of roughly seven and a half months is the single most striking fact in the record. Notification timelines vary by state law and the time required to complete an investigation, so the length alone does not prove fault. It does, however, mean that anyone whose information was taken had that information circulating for an extended period before they were told.

What the exposed personal information actually enables

The record lists personal information as the category exposed. In practice this typically includes name, address, date of birth, and contact details. These pieces of data do not expire. While no permanent government identifiers such as Social Security numbers were exposed, the combination of name, address, and date of birth remains valuable to identity thieves for years. Criminals can use it to attempt account takeover on existing services, file fraudulent tax returns, or build synthetic identities.

Because no passwords or login credentials were exposed, this incident does not put your David’s Bridal account itself at direct risk of takeover. That is genuinely good news. The danger lies in the long-term value of the biographical details now in unknown hands.

How this breach changes your risk profile

Once personal information leaves a company’s control, it cannot be retrieved. The people whose records were included now face an elevated risk of targeted fraud that may not appear for months or even years. Thieves often wait until the initial publicity fades before testing the data in smaller, harder-to-detect schemes.

The absence of Social Security numbers or financial account numbers in the disclosed categories limits some of the worst immediate harms, such as direct tax fraud or bank account draining. Yet the remaining personal information is still sufficient for convincing spear-phishing attacks and for piecing together larger identity profiles when combined with data from other breaches.

Why the letter is the only reliable way to know

David’s Bridal is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely your information was not part of this incident. However, anyone who has moved since January 20, 2024, should contact the company directly to confirm whether their records were involved. Letters can go to outdated addresses and may still arrive late.

The limits of what this filing tells us

The record does not disclose how the breach occurred, whether data was copied or simply viewed, or the precise fields exposed for each person. It also does not name any third-party vendor or state that ransomware was involved. These details remain unknown. What matters most to you is the concrete exposure of personal information affecting 46,165 people and the unusually long 237-day period before notification.

Because the exposed data cannot be changed or revoked, the practical focus shifts to vigilance. Monitor for unexpected credit inquiries, tax documents you did not file, or communications that reference your David’s Bridal history in suspicious ways. The breach itself is now a permanent part of your personal risk history even though the company has now notified those affected.

The filing stands as a reminder that personal information collected for routine retail transactions can retain criminal value long after the original purpose is forgotten. In this case, that value persisted for at least 237 days before the people whose records were taken learned about it.