QualDerm Partners, LLC Data Breach Notice (Oregon Attorney General)

The December 23, 2025 breach at QualDerm Partners exposed the personal information of 3,117,874 people. The company filed its notification with the Oregon Department of Justice exactly 62 days later on February 23, 2026.

Two months passed between the incident and the filing

That interval is the single most concrete fact in the public record. The filing lists the incident date as December 23, 2025 and the submission date as February 23, 2026. Notification timelines vary by state and by when an internal investigation concludes, so the record does not establish whether the gap was unusual. It simply states both dates and the resulting 62-day period.

What the exposed personal information actually means for you

The filing names only one broad category: personal information. No passwords, no financial account numbers, no medical records, and no government identifiers such as Social Security numbers appear in the disclosed categories. This is genuinely good news. The absence of those fields removes several of the most damaging vectors that usually follow a breach.

Still, the personal information that was exposed remains permanently sensitive. Once it leaves the organisation’s control it cannot be taken back. If you were among those notified, that data can be used to attempt identity theft, open fraudulent accounts in your name, or impersonate you in contexts where only basic personal details are required for initial verification.

How to know whether this breach includes you

QualDerm Partners is required to notify affected individuals directly, usually by mail to the last known address on file. If you have not received a letter, it is likely that your records were not part of the exposed group. However, anyone who has moved since December 23, 2025 should contact the organisation directly to confirm their status. Absence of a letter is meaningful but not absolute proof.

The permanent risk that remains

Even limited personal information can serve as the foundation for more sophisticated fraud when combined with data obtained elsewhere. Criminals routinely stitch together records from multiple breaches. What makes this incident noteworthy is its scale — more than three million people — rather than the depth of any single record.

Because no permanent government identifiers were exposed, the long-term damage profile is lower than in many healthcare-related incidents. You do not face the irreversible compromise that comes with a lost Social Security number or passport. That distinction matters. It narrows the realistic threats you need to monitor.

What you can still control

The parts of your identity that cannot be changed were not included. The parts that can be monitored and corrected remain under your influence. Credit reports, account alerts, and careful verification of new applications are still effective defenses here.

Place a fraud alert or credit freeze if you have not done so already. Review your Explanation of Benefits statements from any dermatology or medical providers linked to QualDerm Partners. Watch for unexpected mail, calls, or online accounts opened in your name using familiar personal details.

The record does not disclose the initial access method, whether encryption was used, or how long any unauthorised access lasted. Those uncertainties cannot be resolved from the filing. What matters most is the narrow scope of what was confirmed exposed and the large number of people affected.

Focus on the risks that actually apply

Do not spend time changing passwords for QualDerm Partners. No credentials were exposed. Direct your attention instead to the downstream consequences of personal information appearing in the wrong hands: unexpected credit inquiries, tax-related fraud, or medical identity issues that surface months or years later.

Because the exposed category is broad but shallow, the practical steps you take now can meaningfully limit harm. The two-month gap between incident and notification is the detail most likely to concern people who received a letter. The filing itself offers no further explanation of that interval.

Three million records represent one of the larger healthcare-related notifications filed in Oregon in recent years. The scale alone justifies treating the letter seriously even though the categories listed are narrower than many fear.