Thede Culpepper Moore Munroe & Silliman LLP Data Breach Notice (Oregon Attorney General)

Thede Culpepper Moore Munroe & Silliman LLP has notified 1,259 Oregon residents that their personal information was exposed in an incident that occurred on April 11, 2024. The law firm filed the notice with the Oregon Department of Justice on May 15, 2025 — 399 days later.

Personal information exposed in a law firm breach carries long-term risk

If you received a letter from the firm, your name and other personal information were among the records involved. That information does not expire. While the filing does not list Social Security numbers, financial account details, or medical data, the personal information that was exposed can still be used to build convincing profiles for identity theft, account takeover attempts, or targeted fraud.

The 399-day gap between the incident and the notification is the most striking detail in the record. State law sets different clocks depending on when an investigation concludes, so the delay does not automatically signal wrongdoing. It does, however, mean that anyone affected has lived with unknown exposure for more than a year before learning about it.

What the exposed personal information actually enables

Names combined with addresses, dates of birth, or other identifiers remain valuable to criminals long after a breach. Fraudsters can use them to:

• apply for credit or government benefits in your name
• file fraudulent tax returns
• create synthetic identities by mixing your details with stolen data from other sources

Because no passwords were exposed, this incident does not put any of your online accounts at direct risk from credential theft. That is genuinely good news. The threat here is not immediate account takeover but the slower, more persistent danger of identity fraud that can surface months or years later.

How to determine whether this notice applies to you

The firm is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely your information was not included. However, if you have moved since April 11, 2024, a letter may have gone to an old address. In that case, contact Thede Culpepper Moore Munroe & Silliman LLP directly to confirm whether you were in the group of 1,259 people affected.

The permanent nature of personal data

Unlike a credit card or password, the core personal information listed in this filing cannot be cancelled or reissued. Once it is out, it stays out. This is why the passage of 399 days matters: the data has had more than a year to circulate among criminals who specialize in packaging and selling stolen identities.

The filing does not disclose the exact attack vector, whether the data was encrypted at rest, or how the exposure occurred. Those details remain unknown to the public. What is known is that 1,259 people’s personal information left the firm’s control on or around April 11, 2024.

Practical steps that address this specific exposure

• Place a fraud alert or credit freeze with the three major credit bureaus. This is the single most effective step. It forces lenders to verify your identity before opening new accounts in your name.
• Review your credit reports from Equifax, Experian, and TransUnion every four months. Look for accounts or inquiries you do not recognize. You are entitled to one free report from each bureau per year.
• File your taxes early and monitor any IRS communications. Fraudulent tax returns are a common consequence of personal information exposure. Submitting your return first reduces the chance someone else files using your details.
• Be extremely cautious with unsolicited calls, texts, or emails claiming to be from banks, government agencies, or the law firm itself. Criminals often use exposed personal data to make these contacts sound legitimate.
• Consider identity theft protection services that include dark web monitoring and insurance. While not a perfect shield, they can alert you faster if your information appears for sale and help with recovery costs if fraud occurs.

The record is narrow by design. It tells us who filed, when the incident occurred, when the notice was submitted, how many Oregon residents were affected, and that personal information was exposed. Nothing more. The absence of passwords, financial data, or medical information in the listed categories is meaningful, but the personal information that was exposed still requires your attention.

Take the concrete steps above, document everything, and treat any unexpected financial or government correspondence with suspicion. The exposure happened over a year ago. Your best defense now is vigilance and rapid response if fraud appears.