Pillsbury Winthrop Shaw Pitman LLP Data Breach Notice (Oregon Attorney General)

The personal information of one Oregon resident was exposed in a data breach at Pillsbury Winthrop Shaw Pitman LLP. The law firm filed notice with the Oregon Department of Justice on January 16, 2026, for an incident that occurred on January 01, 2001 — an interval of 9,146 days, or roughly 25 years.

A Quarter-Century Gap Between Incident and Notification

This is the most striking detail in the filing. The breach happened in 2001. Notification reached state regulators only in 2026. The record does not explain the cause of the delay, nor does it state when the firm became aware of the incident. It simply records those two dates and the single person whose information was involved.

What the Filing Actually Discloses

The notification lists only one category: personal information. No passwords, no financial account numbers, no Social Security numbers, no dates of birth, and no government identifiers are named in the record. This absence matters. When a filing omits specific sensitive fields, those fields were not reported as exposed.

Because the exposed category is broad and vague, the practical risk depends entirely on what “personal information” meant in this specific case. The filing does not provide that detail. The only reliable way to know exactly what was taken is the direct notification letter the firm was required to send to the affected individual.

If You Received a Letter

The firm must notify affected Oregon residents directly, usually by mail. If you received such a letter, your records were among those included. If you have not received a letter, it is likely you were not affected. However, if you were a client of the firm around January 2001 and have moved since then, contact Pillsbury Winthrop Shaw Pitman LLP directly to confirm whether your information was part of this filing.

The Permanent Nature of Personal Information

Unlike credit card numbers or passwords, certain personal details cannot be cancelled or reissued. Once they leave an organisation’s control, they remain usable indefinitely. Even limited personal information can be combined with data from other sources to build profiles that support identity fraud or targeted scams. The passage of 25 years does not reduce that risk; in many ways it increases it, because the information may now exist in multiple older datasets that attackers can cross-reference.

What This Means for Identity Theft Risk

A single person’s exposure is unusual in breach filings. Most notices involve hundreds or thousands of records. Here the scale is one. That does not make the incident trivial for the individual involved. A law firm holds highly detailed client files. Even basic personal information drawn from such files can carry more context than data taken from a retail breach.

The record contains no evidence that credentials were exposed. No password-related advice applies here. The risk, if any, flows from the non-credential personal information itself.

Why the 25-Year Delay Stands Out

Notification timelines vary by jurisdiction and by when an investigation concludes. The filing does not characterise the delay as a violation. It simply places the incident in 2001 and the disclosure in 2026. For the person whose data was exposed, the practical effect is the same: their information has been outside the firm’s reported control for a very long time before they were told.

Realistic Steps You Can Take Today

• Review any letter you received from the firm. It is the only document that can tell you precisely which data elements were involved in your case.
• Contact Pillsbury Winthrop Shaw Pitman LLP’s privacy or client records office. Ask for confirmation of exactly what personal information was included and whether it contained any identifiers that could support identity theft.
• Place a fraud alert with the three major credit bureaus. Even without a confirmed Social Security number exposure, a fraud alert adds a layer of protection if your personal details are later used to attempt new credit applications.
• Monitor your credit reports for the next 12 months. Look for accounts or inquiries you do not recognise. Free weekly reports are available from AnnualCreditReport.com.
• Treat unsolicited calls or emails claiming to be from the firm with caution. Use contact details you locate independently rather than those provided in any message.

The filing is narrow. One person. One broad category. A 25-year gap. Those three facts define what is known. Everything beyond them remains undisclosed. The letter you may or may not have received is still the clearest indicator of whether this incident applies to you.