illumifin Corporation Data Breach Notice (Oregon Attorney General)

The filing from illumifin Corporation shows that personal information belonging to 97,781 people was exposed in an incident on October 28, 2025. The organisation submitted its notification to the Oregon Department of Justice on April 22, 2026 — 176 days later.

What This Exposure Actually Means for You

If you received a letter from illumifin, your personal information was among the records involved in this incident. The filing lists personal information as the category exposed. No passwords, no financial account numbers, and no government identifiers that cannot be replaced were named in the record.

That absence is important. Because no passwords were exposed, there is no need to change any password connected to illumifin. The risk here is not account takeover. It is the permanent value that certain personal details carry once they leave the organisation’s control.

The 176-Day Gap Between Incident and Notification

The record states the incident occurred on October 28, 2025 and the filing was made on April 22, 2026. That interval of nearly six months is the single most concrete fact in the disclosure. Notification timelines vary by state law and by when an internal investigation concludes, so the filing does not establish fault. It does establish that affected Oregon residents waited 176 days from the recorded incident date before receiving official notice.

Why Personal Information Retains Value Long After the Breach

Names combined with addresses, dates of birth, or other identifiers remain useful to identity thieves years later. Unlike a credit card that can be cancelled or a password that can be reset, these details cannot be reissued. They can be used to build synthetic identities, file fraudulent tax returns, open accounts in your name, or support more sophisticated social engineering.

The scale — 97,781 individuals — makes this one of the larger notifications filed in Oregon this year. The volume increases the chance that the information will circulate among criminal networks that specialise in long-term monetisation of personal data.

How to Determine Whether You Were Affected

Illumifin is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely your records were not part of the exposed group. However, if you have moved since October 28, 2025, the letter may have gone to an old address. In that case, contact illumifin directly to confirm whether your information was included.

What Remains in Your Control

Even when personal information has been exposed, you can still limit what criminals do with it. The key is reducing the number of places where that information can be used to create new accounts or loans in your name.

Place a freeze with the three major credit bureaus. This prevents new credit accounts from being opened without your explicit permission. A freeze does not affect your existing accounts or credit score, and it can be lifted temporarily when you need to apply for new credit.

Monitor your tax filings closely in the coming year. Identity thieves sometimes use stolen personal information to file fraudulent returns before the legitimate taxpayer does. Early filing reduces that window.

Review explanation of benefits statements from any health plans and Explanation of Benefits documents for unexpected claims. Although medical information itself was not listed in this filing, personal details can sometimes be used to facilitate healthcare fraud.

Be extremely cautious with any unsolicited contact that asks you to confirm personal details. Criminals who possess parts of your record may attempt to harvest the rest through phishing calls or emails that appear to come from legitimate companies.

The Difference Between This Incident and Credential Breaches

Because the record contains no indication that credentials were exposed, this is not a situation where changing your illumifin password would protect you. That is genuinely good news. The exposure is limited to personal information whose value is primarily in identity theft rather than direct account compromise.

However, the 176-day delay between the recorded incident and the notification means that any data taken on October 28, 2025 had months to be analysed, packaged, and distributed before the public or the affected individuals learned about it.

The filing establishes that 97,781 people’s personal information was involved. It does not disclose the precise fields for each person, the root cause, or whether the data was copied. What it does make clear is that this information is now outside illumifin’s control and will retain its value to criminals for years.

Focus your effort on the steps you can still take: credit freezes, careful tax monitoring, and vigilance against phishing attempts that use the stolen details to sound legitimate. Those actions remain effective even months after the original incident.