Lasership Inc. dba OnTrac Final Mile (“OnTrac”) Data Breach Notice (Oregon Attorney General)

The April 13, 2025 breach at Lasership Inc. dba OnTrac Final Mile exposed personal information belonging to 40,018 people. Oregon residents learned of it through a filing made on August 27, 2025 — 136 days later.

Four and a Half Months Passed Between the Incident and the Notification

State breach notification rules give organisations time to investigate and confirm what happened. In this case the gap between the incident date of April 13 and the filing on August 27 was more than four months. That interval is the single most concrete fact the public record provides.

What “Personal Information” Means Here

The filing lists only one category: personal information. No passwords, no financial account numbers, no Social Security numbers, no driver’s license numbers, and no medical details appear in the disclosed categories. This is genuinely good news. The absence of those high-risk identifiers sharply limits what an attacker could do with any data that was taken.

Names combined with addresses and dates of birth still carry value on the underground market. They can be used to support synthetic identity fraud, to attempt account takeover on other services where you reuse details, or to craft more convincing phishing messages and vishing calls. Those risks do not expire quickly.

Your Situation If You Received a Letter

If OnTrac sent you a notification, your records were among those included in the incident. The company is required to contact affected individuals directly, almost always by mail to the last known address. Absence of a letter usually means your information was not part of the exposed group. However, if you have moved since April 13, 2025, it is worth contacting OnTrac to confirm whether your records were involved.

What Remains Permanent and What You Can Still Control

No permanent government or biographic identifiers such as Social Security numbers were exposed. That removes the longest-lasting consequence of many breaches. What was taken cannot be changed, but the lack of credential data and sensitive identifiers means the immediate risk profile is lower than in many reported incidents.

The data’s usefulness for identity theft diminishes over time, yet a name-plus-address combination can still help someone impersonate you in lower-assurance situations years from now. The exposure therefore matters most in the context of other breaches you may have experienced. Attackers rarely rely on a single record.

Why the Exact Attack Method Was Not Disclosed

The Oregon filing, like most state notifications, does not describe how the intruder gained access, whether data was copied or simply viewed, or how long any unauthorised access lasted. Those details remain unknown to the public. The record establishes only that an incident occurred, that personal information was involved, and that 40,018 individuals were affected.

Practical Steps That Address This Specific Exposure

• Review recent statements from any delivery, shipping, or logistics accounts you hold with OnTrac or related services. Look for changes to contact details or unexpected activity even though no credentials were exposed.
• Treat any unsolicited call, email, or text claiming to be from OnTrac with extra caution. The exposed personal information makes it easier for someone to sound legitimate when asking you to confirm details or click a link.
• Place a freeze on your credit reports at Equifax, Experian, and TransUnion. Even without a Social Security number exposed, the added friction stops most new-account fraud that could be attempted with basic personal details.
• Monitor your mailbox and email for any new account-opening confirmations or collection notices. Early detection remains the most effective control when partial personal information is circulating.
• If you have moved since April 2025, contact OnTrac’s customer service directly to verify whether your records were in the affected group. A letter sent to an old address may never have reached you.

The filing provides a narrow set of facts. No passwords were exposed. No high-risk identifiers were listed. The delay between the April incident and the August notification is the clearest newsworthy element. For most people who receive the letter, the practical outcome is heightened vigilance rather than immediate compromise. The steps above focus on the specific categories that were involved and the information that was explicitly not involved.