Impac Mortgage Holdings, Inc. Data Breach Notice (Oregon Attorney General)

The filing from Impac Mortgage Holdings, Inc. shows that personal information belonging to 61,066 people was exposed in an incident that occurred on February 21, 2024. The company did not notify Oregon authorities until April 17, 2026 — an interval of 786 days, or roughly 26 months.

Personal information exposed in this incident remains valuable for years

If you received a notification letter from Impac Mortgage Holdings, the records included in this breach contain details that identity thieves still actively use. The filing lists personal information as the category exposed. No passwords were exposed. No permanent government identifiers such as Social Security numbers are named in the record.

That absence matters. Without an SSN or equivalent biographic identifier, the immediate risk of new account fraud opened solely with this data is lower than in many breaches. However, the exposed personal information can still be combined with data from other sources to strengthen fraudulent applications, support phishing campaigns, or impersonate you in dealings with banks, insurers, or government agencies.

What the 26-month gap actually means for you

The long delay between the February 2024 incident and the April 2026 filing is the most striking fact in the record. Notification timelines vary by jurisdiction and by when an internal investigation concludes. The filing itself does not disclose when the company discovered the incident or how long any data may have been accessible. What it does show is that more than two years passed before Oregon residents were formally notified through this channel.

During that period, the exposed personal information could have circulated. The record does not state whether the data was copied, exfiltrated, or simply viewed. In practice, anyone whose details were included must assume the information is now outside the company’s control.

How to determine whether this breach affects you

Impac Mortgage Holdings is required to notify affected individuals directly, usually by mail to the last known address on file. If you have not received such a letter, it is likely that your records were not part of the group of 61,066 people named in the filing. However, if you have moved since February 2024, a letter may have gone to an old address. In that case, contact the company directly to confirm whether your information was involved.

The lasting nature of personal information exposure

Unlike a credit card number that can be replaced, personal information tied to your name and history does not expire. Lenders, employers, and service providers routinely ask for the same details that may now sit in unknown hands. This creates a permanent background risk: someone with access to the breached data can use it to appear more legitimate when attempting fraud or social engineering.

The absence of exposed passwords is genuine good news here. You do not need to change any Impac Mortgage password because of this incident. The record contains no credential data, so there is no risk of account takeover stemming directly from this filing.

What this breach changes about your daily vigilance

Because the exposed category is personal information, the practical effect is increased noise in your inbox and mailbox. You are more likely to encounter targeted phishing attempts that reference your mortgage history or other dealings with Impac. Scammers may claim they are updating your loan records or need to verify details before releasing funds.

Any unsolicited communication that asks you to confirm personal details, click a link, or provide additional information should be treated as suspicious. Verify directly with the company using contact details you locate independently rather than those supplied in the message.

Practical steps that address this specific exposure

• Monitor your credit reports for new accounts opened in your name. Pull free weekly reports from AnnualCreditReport.com and look for activity you do not recognize.
• Place a fraud alert with the three major credit bureaus. A fraud alert requires lenders to take extra steps to verify your identity before issuing new credit.
• Review every explanation of benefits or account statement from lenders and insurers that worked with Impac. Look for loans, payments, or inquiries you did not authorize.
• Treat any call or email referencing your mortgage or personal records as potentially fraudulent. Hang up or delete and contact the company through official channels you initiate yourself.
• If you have moved since February 2024, reach out to Impac Mortgage Holdings directly. Confirm whether your records were included in the group of 61,066 affected individuals.

The filing establishes that personal information for 61,066 people was exposed on February 21, 2024, with notification occurring 786 days later. No passwords or permanent identifiers are listed in the record. The letter you may or may not have received remains the clearest indicator of whether you are personally affected. Where that letter is absent and you have changed addresses since the incident date, direct confirmation from the company is the only reliable check available.