Wise US Inc. Data Breach Notice (Oregon Attorney General)

The filing from Wise US Inc. confirms that personal information belonging to some Oregon residents was exposed on June 26, 2024. The company submitted its formal notice to the Oregon Department of Justice on July 23, 2024 — 27 days later. The record does not state how many people were affected.

If you received a letter, this exposure is now part of your permanent record

Personal information listed in the filing cannot be cancelled or reissued the way a compromised credit card can. Once it has left Wise’s systems, it stays available to whoever obtained it. That single fact changes the risk calculation for anyone whose details were included.

What the exposed personal information actually enables

With sufficient personal information, identity thieves can attempt to open new accounts, file fraudulent tax returns, or impersonate you when dealing with government agencies and financial institutions. The value of this data does not expire quickly. Criminal markets treat fresh personal records as reliable inputs for long-term fraud schemes.

The notice does not list Social Security numbers, driver’s license numbers, financial account details, or any other category beyond the broad term “personal information.” No passwords were exposed. This means your Wise account credentials themselves were not part of the incident, and you do not need to change your Wise password because of this breach.

The letter is the only reliable way to know if you are included

Wise is required to notify affected individuals directly, usually by mail. If you have not received a letter at your last known address, it is likely your information was not part of this incident. However, if you have moved since June 26, 2024, the letter may have gone to an old address. In that case, contact Wise directly to confirm whether your records were involved.

Why the 27-day timeline matters

The gap between the incident date and the filing date is unusually short for breach notifications. Most organisations take longer to investigate, contain the issue, and prepare customer notices. The rapid timeline suggests Wise had already identified the affected population and prepared notifications by late July. While the filing does not explain how the data was accessed or who accessed it, the speed of disclosure limits the window during which the exposed information remained unknown to those responsible for protecting it.

What remains under your control

Even though some personal information cannot be changed, several practical protections are still available. The most effective steps focus on monitoring and blocking the specific types of fraud this exposure makes easier.

• Place a fraud alert or credit freeze with the three major credit bureaus. This forces lenders to verify your identity before opening new accounts in your name. A freeze is the stronger option and remains free.
• Monitor your tax filings closely. Identity thieves sometimes use stolen personal information to file fake returns and claim refunds. Check your IRS online account regularly and set up alerts for any unexpected activity.
• Review explanations of benefits and banking statements for unfamiliar transactions. Even without financial account numbers listed in the filing, thieves may attempt to link your identity to new accounts elsewhere.
• Be extremely cautious with unsolicited requests for personal information. Phone calls, emails, or texts claiming to be from Wise, government agencies, or banks should be treated as suspicious. Verify any request by contacting the organisation through official channels you initiate yourself.

The exposure is permanent but the damage is not inevitable

Receiving a breach letter creates a permanent increase in risk, yet most people whose information is exposed never become victims of identity theft. The difference usually comes down to early detection and deliberate barriers against new-account fraud. By treating this incident as a permanent change in your threat profile rather than a one-time event, you can focus effort where it still makes a difference.

The record leaves several important details unknown, including the exact root cause and whether the actor was external or internal. Those uncertainties do not change what matters most to you today: certain personal information left Wise’s control on June 26, 2024, and you now have a heightened need for vigilance and protective controls that the company itself cannot provide.