International Grand Investment Corp. Data Breach Notice (Oregon Attorney General)

The personal information of 250 Oregon residents is now in unknown hands following a data breach at International Grand Investment Corp. The incident occurred on September 01, 2025, and the company filed its notification with the Oregon Department of Justice on October 15, 2025 — a gap of 44 days.

If you received a letter from the company, your records were among those affected. The filing does not disclose the exact nature of the “personal information” involved beyond that broad category, nor does it state whether the data was copied and taken or simply viewed. What matters is that this information has now left the company’s control.

The 44-Day Gap Between Incident and Notification

The record shows the breach took place on September 1 and the formal filing arrived 44 days later. State notification rules allow time for investigation, but this interval is the central fact of the public record. The filing itself provides no discovery date, so it is not possible to know how long the company was aware of the problem before notifying regulators.

What Personal Information Exposure Actually Enables

Names combined with other personal details are the foundation for identity theft, fraudulent loan applications, tax fraud, and impersonation schemes. Because the filing uses only the general term “personal information,” affected individuals must treat the exposed data as sufficient for these crimes until their own notification letter clarifies exactly what was taken.

No passwords were exposed. No financial account numbers, no driver’s license numbers, and no government identifiers beyond what the single broad category covers. This is genuinely good news: there is no credential risk here, and you do not need to change any passwords because of this incident.

How Long This Risk Lasts

Unlike a credit card that can be canceled, personal information of this kind does not expire. The records taken in September 2025 can be used for identity-related fraud years from now. Criminal markets treat such data as long-term inventory precisely because it cannot be reissued like a payment card.

The company is required by law to notify affected Oregon residents directly, usually by mail. If you have not received a letter, it is likely your information was not included in the group of 250. However, if you have moved since September 01, 2025, or changed addresses without updating the company, you should contact International Grand Investment Corp. directly to confirm whether you were affected.

What the Limited Filing Leaves Unanswered

The notification does not describe how the breach occurred, whether the data was exfiltrated, or what security measures were in place. These details remain unknown to the public. The record is limited to who filed, when the incident is dated, what broad category of information was involved, and how many people were affected in Oregon.

Placing Yourself in the Group of 250

Only a small number of customers were impacted relative to any typical investment firm’s client base. The letter you may or may not have received is the only reliable way to know your status. Absence of a letter usually means you were not in the affected group, but anyone uncertain because of an address change since the September 1 incident date should reach out to the company for verification.

Practical Steps That Match This Specific Exposure

• Monitor your credit reports and accounts closely for the next 12–24 months. Place a fraud alert or credit freeze if you have not already done so; this is the most direct way to block new accounts opened in your name using stolen personal details.
• Watch for unexpected tax documents or IRS communications. Identity thieves sometimes file fraudulent returns with stolen personal information. File your taxes early to reduce the window in which someone else can file using your details.
• Be extremely cautious with unsolicited calls, emails, or messages claiming to be from your investment firm or government agencies. Verify any request for information by contacting the company through a known good number or portal rather than responding to the contact.
• Review your explanation of benefits and financial statements for unfamiliar activity. Even though the filing does not list banking details, personal information can be used to redirect legitimate accounts or trigger related fraud.
• Contact International Grand Investment Corp. directly if you have moved since September 2025 or never received a letter but believe you may have been a customer during that period. Only they can confirm whether your specific records were included.

This breach is narrow in scope — 250 people — yet the information involved carries permanent value to identity thieves. The letter in your mailbox remains the definitive answer to whether you are one of them. Treat the possibility seriously, act on the controls you still hold, and ignore any advice that tells you to change passwords for this incident. None were exposed.