Integrated Specialty Coverages, LLC ("ISC") Data Breach Notice (Oregon Attorney General)

The February 16, 2025 breach at Integrated Specialty Coverages, LLC exposed personal information belonging to 146,963 people. The company filed its notification with the Oregon Department of Justice on July 02, 2025 — 136 days later.

Four and a half months passed between the incident and the filing

That interval is the single most concrete fact in the public record. State notification rules allow time for investigation, but the gap is long enough to matter to anyone whose records were involved. The filing itself does not explain the cause or the precise sequence of events.

What was actually exposed

The record lists only one broad category: personal information. No passwords, no financial account numbers, and no permanent government identifiers beyond what the filing explicitly names. This means the breach does not create immediate account takeover risk at ISC itself. The exposed data retains long-term value for identity theft and fraud because names combined with other personal details can be used to impersonate people in future dealings with banks, insurers, government agencies, and employers.

The letter is the only reliable way to know if you were affected

Integrated Specialty Coverages is required to notify affected individuals directly, usually by mail. If you have not received a letter, your information was most likely not included. However, if you have moved since February 16, 2025, the letter may have gone to an old address. In that case, contact the company directly to confirm whether your records were part of the incident.

What this exposure actually enables

Personal information of this kind is valuable because it cannot be changed. A name and associated details can support synthetic identity fraud, tax refund fraud, or medical identity theft months or years from now. Because no passwords or login credentials were exposed, the immediate risk is not that someone will log into your ISC account. The risk is that the same details will appear in future breaches or be sold quietly on underground markets, gradually building a profile that makes other forms of impersonation easier.

The difference between changeable and permanent risk

Credit cards and passwords can be replaced. The core personal details named in this filing cannot. That permanence is why monitoring matters more than one-time fixes. The data does not expire; the exposure does not have a natural shelf life. Anyone whose information was taken must assume the details are now outside their control and will require ongoing vigilance rather than a single response.

Concrete steps that address this specific exposure

• Place a fraud alert or credit freeze with the three major credit bureaus immediately. This is the most effective single action because it forces lenders to verify identity before new accounts can be opened in your name.
• Review your Explanation of Benefits statements from every health insurer you have used. Look for claims you did not file or services you did not receive. Medical identity theft often surfaces slowly through incorrect billing records.
• Set up free annual credit reports and check them every four months. Stagger the requests across Equifax, Experian, and TransUnion so you see fresh data year-round rather than once annually.
• Be extremely cautious with any unsolicited contact that asks you to confirm personal details. Scammers now have more pieces of the puzzle and can sound more convincing.
• Keep records of the breach notice and your communications with ISC. If identity theft appears later, these documents help prove when the exposure occurred and that you took reasonable steps.

The filing establishes that 146,963 individuals had personal information included in the February 16 incident. It does not state how the breach occurred, whether data was copied, or how long any unauthorized access lasted. Those details remain outside the public record. What is known is narrow but permanent: the exposed information cannot be taken back, and its value to identity thieves does not diminish with time.

Focus your effort on the protections you can still control — credit monitoring, fraud alerts, and careful verification of any financial or medical activity tied to your name. The letter you may or may not have received remains the clearest signal of whether this particular record applies to you.