Oregon Food Bank Data Breach Notice (Oregon Attorney General)

The Oregon Food Bank notified 1,254 people that their personal information was exposed in an incident that occurred on October 24, 2025. The organization filed the notice with the Oregon Department of Justice on April 20, 2026 — 178 days later.

Personal information exposed carries permanent risk

If you received a letter from the Oregon Food Bank, your personal information is now in the hands of whoever accessed it during that incident. Unlike a credit card or password, the core details listed in this filing cannot be cancelled or reissued. They remain useful for identity theft, fraudulent accounts, tax fraud, and targeted scams for years.

The filing lists personal information as the category exposed. No passwords, no financial account numbers with routing details, and no government identifiers such as Social Security numbers were included in the exposed data according to the record. That absence is meaningful: it removes the most immediate high-risk vectors that often drive urgent password changes or credit freezes.

What this exposure actually enables

Personal information from a nonprofit donor or client database is valuable because it ties a name to an address, phone number, email, or donation history. Fraudsters can use these details to craft convincing phishing emails that reference past giving, impersonate the organization, or combine the data with information from other breaches to build a more complete profile.

Because this breach involves donor and client records, the exposed information often connects directly to people’s charitable activity and personal circumstances. Scammers frequently exploit nonprofit data to create fake emergencies, request additional donations, or pose as legitimate fundraisers. The 178-day gap between the October 2025 incident and the April 2026 notification gave potential attackers ample time to make use of whatever was obtained.

The letter is the only reliable way to know if you are affected

Oregon Food Bank is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely your information was not part of the group of 1,254 people included in this filing. However, if you have moved since October 24, 2025, or changed addresses without updating the organization, you should contact Oregon Food Bank directly to confirm whether your records were involved.

Absence of a letter is generally a positive signal, but it is not absolute proof. The safest approach is to treat any recent communication claiming to be from the Oregon Food Bank with extra caution and verify it independently before responding.

Long-term value of nonprofit donor data

Donor and client records from food banks and similar organizations retain their usefulness far longer than many people assume. A name paired with contact details and history of support can be resold or reused on dark web marketplaces for a long time. This data is particularly attractive for spear-phishing campaigns that reference specific past interactions to appear legitimate.

The fact that no passwords or credentials were exposed means your existing Oregon Food Bank account — if you have one — is not directly at risk of takeover from this incident. That is genuinely good news and removes one major source of immediate worry. The remaining exposure centers on identity-related fraud rather than account compromise.

Protecting yourself when personal information is already loose

With personal information exposed, the focus shifts from prevention of the breach itself to limiting what attackers can do with it. You still control several important defenses that the exposed data cannot override.

• Place a fraud alert or credit freeze with the three major credit bureaus. Even without a Social Security number listed in this filing, a fraud alert makes it harder for someone to open new accounts using any personal details they may have obtained or combined from other sources.
• Monitor your bank, credit card, and tax-related accounts closely for the next 12 to 24 months. Look for small test charges, unfamiliar addresses, or unexpected tax documents. Early detection limits damage.
• Be extremely wary of any unsolicited contact claiming to be from Oregon Food Bank. Verify requests for information or donations by contacting the organization through a known good phone number or website, never through links or numbers provided in the suspicious message.
• Review your annual credit reports from Equifax, Experian, and TransUnion. Check for accounts or inquiries you do not recognize. You are entitled to one free report from each bureau every year.
• Consider identity theft protection services that include dark web monitoring for your name and contact details. While not a guarantee, these services can alert you if pieces of your exposed personal information appear for sale.

The 178-day interval between the incident on October 24, 2025 and the filing on April 20, 2026 is the most notable detail in this record. Notification timelines vary by the complexity of the investigation and state requirements, but the gap is long enough to warrant heightened vigilance.

This breach affects 1,254 people according to the filing. While that number is relatively modest compared with many corporate incidents, each individual record carries real weight when the data involved is personal information tied to charitable activity and daily life circumstances.

You cannot change what happened in October 2025. You can, however, limit how much further damage occurs by treating every unexpected communication as suspect and maintaining strong monitoring habits going forward. The letter you may or may not have received remains the clearest indicator of whether you personally fall within the affected group.