Enstar (US), Inc. Data Breach Notice (Oregon Attorney General)

The filing from Enstar (US), Inc. means that personal information belonging to 75,101 people was exposed in an incident that occurred on May 30, 2023. The company did not notify Oregon authorities until May 3, 2024 — an interval of 339 days, or roughly 11 months.

That long gap between the incident and the official filing is the single most striking fact in the record. While notification deadlines vary by state and depend on when an investigation concludes, nearly a year is long enough for anyone whose records were included to feel the delay.

What the Exposed Personal Information Actually Means

The record lists only one broad category: personal information. It does not include passwords, and no permanent government identifiers such as Social Security numbers were exposed. This is genuinely good news. Without those high-value identifiers, the immediate risk of new account fraud or tax-related identity theft is lower than in many breaches that reach this scale.

However, the exposed personal information still carries long-term value. Names combined with contact details, dates of birth, or policy information can be used for more targeted fraud attempts, phishing campaigns, or impersonation schemes months or years later. Once personal information leaves an organisation’s control, it cannot be taken back.

The 75,101 People Affected

Enstar (US), Inc. is required to notify affected individuals directly, usually by mail to their last known address. If you received a letter from the company, your information was part of this incident. If you have not received any correspondence, it is likely that you were not in the affected group.

Anyone who has moved since May 30, 2023 should contact Enstar directly to confirm whether their records were included. Letters can go astray, addresses can be outdated, and absence of mail is not absolute proof of safety.

Why the Delay Matters to You

A nearly eleven-month period between the breach date and the filing date leaves a long window during which the exposed data could have been used or shared before most people knew it existed. The record does not disclose when the company discovered the incident, how the data was accessed, or whether it was exfiltrated. Those details remain unknown.

What is known is that 75,101 individuals’ personal information is now outside Enstar’s systems. The passage of time does not reduce the value of that data to fraudsters who collect and reuse personal details over years.

What You Can Still Control

Even without exposed Social Security numbers or passwords, vigilance remains the most practical protection. The absence of credentials in this breach means you do not need to change any Enstar password, but you should treat any unexpected contact claiming to be from the company with extra caution.

Monitor your financial accounts and explanation of benefits statements for unfamiliar activity. Place a fraud alert with the three major credit bureaus if you want an additional early-warning layer. Consider freezing your credit if you rarely open new accounts. These steps do not undo the exposure, but they limit what someone can do with the personal information now in circulation.

The record contains no evidence of ransomware, vendor involvement, or specific attack methods. It simply establishes that personal information for 75,101 people was exposed on May 30, 2023 and that notification to Oregon occurred 339 days later.

That combination — a large number of people, a single broad category of data, and a lengthy notification interval — is what this incident leaves you with. The letter in your mailbox, or its absence, remains the clearest way to know whether you are personally affected.