New York Blood Center Enterprises Data Breach Notice (Oregon Attorney General)

The New York Blood Center Enterprises disclosed a breach affecting 193,822 people, including Oregon residents, with the incident occurring on January 20, 2025 and the filing submitted on September 05, 2025 — an interval of 228 days.

Personal information from blood donor and patient records is now exposed

If you received a notification from the New York Blood Center Enterprises, your personal information was included in this incident. The filing lists personal information as the category exposed. No passwords, no financial account numbers, and no permanent government identifiers such as Social Security numbers were part of the exposed data according to the record.

This matters because medical organizations hold information that often links directly to your health history. Even without a Social Security number attached, personal details tied to blood donations or transfusions can be used to attempt identity theft, fraudulent medical claims, or targeted scams that reference your specific interactions with the organization. The absence of the most dangerous identifiers is genuinely good news, but the exposure still creates long-term risk that cannot be undone.

What the 228-day gap between incident and filing means for you

The breach happened on January 20, 2025. The organization filed the notice with Oregon authorities on September 05, 2025. That seven-and-a-half-month period is the most notable fact in the public record. Notification timelines vary by state law and the time needed to complete an investigation, so the gap itself does not prove wrongdoing, but it does mean many affected individuals waited most of a year for official word.

During that time the records were already considered compromised. Anyone whose information was taken could have faced attempted fraud well before receiving any letter. The delay does not change what you should do now, but it explains why you may want to treat this notification as more urgent than the date on the envelope suggests.

How to determine whether this breach actually includes you

The organization is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely your records were not part of the 193,822 affected in this filing. However, if you have moved since January 20, 2025 or changed addresses with the Blood Center, contact them directly to confirm whether you were included. A letter sent to an old address may never have reached you.

The permanent nature of medical-context personal data

Unlike a credit card or password, the personal information tied to your history with a blood center cannot be replaced. Once it is out, it stays out. Fraudsters can use donor or patient details to build convincing profiles for synthetic identity fraud, to support fake medical billing schemes, or to add credibility to phishing attempts that reference your actual donation history.

Because no passwords were exposed, you do not need to change any password related to the New York Blood Center. That particular risk does not apply here. The real ongoing concern is the non-replaceable personal information and its connection to your health records.

What this exposure enables that matters most

Personal information from a blood center can be combined with data from other breaches to create more complete profiles. A scammer who already has your name and date of birth from elsewhere now gains confirmation of your relationship with a major blood organization. That detail can make spear-phishing emails or phone calls significantly more believable.

Medical identity theft remains a realistic threat. Someone could attempt to obtain services in your name or file fraudulent claims that eventually affect your insurance records. Monitoring explanation of benefits statements and insurance explanations of payment becomes more important than it was before this disclosure.

Practical steps that address this specific exposure

• Place a fraud alert with the three major credit bureaus. Even without a Social Security number listed, the personal information exposed can support identity theft attempts. A fraud alert forces lenders to verify your identity before opening new accounts.
• Review your Explanation of Benefits statements carefully for the next 12 to 24 months. Look for any claims or services you did not receive. Medical identity theft often surfaces first through insurance paperwork.
• Contact the New York Blood Center Enterprises directly if you have moved since January 2025. Confirm whether your records were in the affected group and update your contact information so future notices reach you.
• Be extremely cautious with any unsolicited contact that references your blood donation or transfusion history. Treat such calls or emails as suspicious even if they appear to come from a familiar medical organization.
• Consider freezing your credit if you rarely open new accounts. This is the strongest preventive step against new-account fraud that could stem from this breach.

The record shows that 193,822 people were affected. The filing does not disclose the exact initial access method or confirm whether data was copied and exfiltrated. What it does establish is that personal information left the organization’s control on or around January 20, 2025 and that notification came more than seven months later.

This leaves you with imperfect but actionable choices. You cannot retract the data, but you can limit what criminals can build with it by staying vigilant about medical billing, credit activity, and unexpected contact that references your history with the Blood Center. The letter you received is the clearest evidence that this incident includes you. Treat it as a permanent addition to your personal risk profile rather than a one-time event.