Marquis Software Solutions, Inc. Data Breach Notice (Oregon Attorney General)

The data breach at Marquis Software Solutions, Inc. means that personal information belonging to 13,169 people is now outside the company’s control. The filing lists personal information as exposed in the incident that occurred on August 14, 2025. The company did not notify Oregon authorities until December 15, 2025 — an interval of 123 days, or roughly four months.

Personal Information That Cannot Be Replaced

When a company holds your name together with other identifying details, those records can be used for identity theft and fraud long after the breach itself fades from the news. The Oregon filing confirms that personal information was involved. No passwords were exposed. No financial account numbers, no driver’s license numbers, and no medical information appear on the list of exposed categories.

This is genuinely good news on the credential side. Because no passwords or login details were listed, there is no need to change any password connected to Marquis Software Solutions. The risk you face is the long-term value of the personal information itself, not an immediate account takeover.

What the 123-Day Gap Actually Means

The record shows the incident date of August 14, 2025 and the filing date of December 15, 2025. That four-month gap is the single most concrete fact in the notification. Notification timelines vary by state law and by when an internal investigation concludes, so the filing does not establish fault. It does establish that more than four months passed between the incident and the formal notice to regulators.

During that period the company investigated the matter. The filing does not disclose how the incident began, whether data was copied or simply viewed, or how long any unauthorized access lasted. Those details remain unknown to the public.

How to Know If This Breach Affects You

Marquis Software Solutions is required to notify affected individuals directly, usually by mail to the last known address. If you received a letter from the company, your information was included in this incident. If you have not received any letter, it is likely you were not in the group of 13,169 affected Oregon residents. However, if you have moved since August 14, 2025, a letter may have gone to an old address. In that case you should contact Marquis Software Solutions directly to confirm whether your records were involved.

The Permanent Nature of Personal Information

Unlike a credit card or password, the core personal details named in most breach filings cannot be cancelled or reissued. Once they leave the company’s systems they remain usable for identity theft for years. The absence of passwords and financial account numbers in this particular filing limits some immediate risks, but the exposed personal information still carries long-term consequences for anyone whose records were taken.

Identity thieves can use accurate name-and-personal-information combinations to open accounts, file fraudulent tax returns, or impersonate you in situations where biometric or documentary proof is not required. The value of that data does not expire when the news cycle moves on.

What Remains Under Your Control

You cannot change the fact that the records existed or that they left the company. You can still reduce what thieves are able to do with them. Monitoring your credit reports, placing a fraud alert, and watching for unexpected tax documents or account openings remain the most practical steps available. These actions do not undo the breach, but they limit the practical harm that can follow from it.

The record is narrow. It tells us who filed, when the incident occurred, when the filing was made, how many Oregon residents were affected, and that personal information was exposed. It does not tell us the initial access method, the length of any unauthorized access, or whether the data was exfiltrated. Those uncertainties are real, but they do not change the concrete situation facing the people whose information appears in the 13,169 records.

The letter you may or may not have received is still the clearest signal available. Absence of a letter usually means your information was not part of this incident, provided your address on file was current as of mid-August 2025. When in doubt, contact the company directly rather than assuming safety or risk.