Decisely Insurance Services Data Breach Notice (Oregon Attorney General)

The December 15, 2024 breach at Decisely Insurance Services has left the personal information of 261,155 people in an uncertain state more than a year later. The company did not file its notification with the Oregon Department of Justice until December 30, 2025 — an interval of 380 days.

One Year and Fifteen Days Passed Before Oregon Residents Were Told

That gap is the single most striking fact in the record. The incident date and the filing date are both public. Between those two fixed points sits more than twelve months during which the exposed records sat somewhere outside the company’s direct control. The filing itself offers no explanation for the delay, and none is required by the format of these notifications. What matters to you is the plain timeline: the event occurred on December 15, 2024; the formal notice reached the state on December 30, 2025.

What the Filing Actually Lists as Exposed

The record names only one broad category: personal information. No passwords, no financial account numbers, no medical records, and no government identifiers such as Social Security numbers are mentioned. This is genuine good news. The absence of those high-risk data types sharply limits what an attacker could do with the information immediately.

Still, names combined with addresses, dates of birth, or policy details retain long-term value. Identity thieves do not need a credit card number today to build a usable profile they can exploit next year or five years from now. Once personal information leaves an organisation’s systems, it cannot be recalled.

Your Situation If You Received a Letter

If Decisely Insurance Services sent you a letter, your records were among those included in the incident. The company is required to notify affected Oregon residents directly, almost always by mail to the last address it holds. Absence of a letter usually means your information was not part of the exposed set. However, if you have moved since December 15, 2024, a letter may have gone to an old address. In that case, contact Decisely directly to confirm whether your records were involved.

What This Exposure Enables

Personal information alone is rarely enough for large-scale immediate fraud, but it is excellent raw material. Fraudsters combine it with data from other breaches to create convincing synthetic identities or to answer security questions on accounts you already hold elsewhere. A date of birth paired with an address and policy number can help an attacker impersonate you when speaking to other insurers, banks, or government agencies.

Because no permanent identifiers such as Social Security numbers were listed, the risk of new account fraud opened in your name is lower than in many insurance breaches. That does not make the incident harmless. It simply means the most urgent monitoring targets are existing accounts and future attempts to use your identity for smaller, harder-to-detect fraud such as medical claims or tax-related filings.

The Value That Does Not Expire

Unlike a credit card, personal details cannot be cancelled or reissued. The information Decisely held about you on December 15, 2024 remains useful to someone who collected it. That permanence is why the long notification delay matters. The longer records sit outside secure systems, the greater the chance they have been copied, shared, or sold on underground markets where patience is common.

What You Can Still Control

You cannot change what happened in 2024. You can reduce the practical impact today. Place a freeze on your credit reports so new accounts cannot be opened without your explicit permission. Review explanations of benefits from every health insurer you use, looking for claims you did not incur. Monitor your tax filings early in the season; identity thieves sometimes file false returns to claim refunds before the legitimate taxpayer does.

Consider placing a fraud alert with the three major credit bureaus. Unlike a freeze, it does not block new credit but flags your file for extra verification. Because the exposed data set does not include account numbers or passwords, you do not need to change credentials with Decisely itself. The risk is not to your Decisely account but to any other service that might treat pieces of your personal information as proof of identity.

Keep records of the notification letter. If you later discover fraud that appears linked to this incident, the documentation will help when dealing with banks, insurers, or credit agencies. Many organisations extend identity protection services after a breach; ask Decisely whether such an offer was included with your letter.

The 261,155 people named in this filing now share a common reality: some part of their personal profile held by an insurance services company is outside the company’s custody. The 380-day gap between the incident and the filing is long enough to be concerning, yet the narrow category of exposed data limits the immediate danger. Treat the information as permanently public, act on the risks that remain controllable, and use the letter you received as the definitive test of whether this particular breach applies to you.