Eyemart Express, LLC Data Breach Notice (Oregon Attorney General)

The data breach at Eyemart Express, LLC means that personal information belonging to 2,638 people is now outside the company’s control. The incident occurred on May 26, 2026, and the company filed its notification with the Oregon Department of Justice on August 04, 2026 — an interval of 70 days.

What the 70-Day Gap Changes for You

That two-and-a-half-month period between the breach date and the official filing is the single most concrete fact in the record. Regulators require timely notification once an organisation has confirmed the scope of an incident. The length of this interval is therefore the clearest signal available about how long it took Eyemart Express to investigate, contain the event, and prepare notifications. The filing itself does not explain the reasons for the delay.

The Personal Information Now at Risk

The Oregon filing lists personal information as the category exposed in this incident. No passwords, no financial account numbers, and no permanent government identifiers such as Social Security numbers were named in the record. That absence is meaningful: the data that can be changed or reissued was not compromised here.

Because the exposed category is limited to personal information, the immediate risks centre on identity-related fraud that does not require a credit card or government ID. Attackers who obtain names combined with contact details or other contextual personal data can attempt more convincing phishing, account takeover attempts on unrelated services, or impersonation in customer-service settings. These tactics remain effective long after the initial breach because personal details do not expire the way a credit card number does.