UnknownInformationHigh

SafetyFirst

bd_52833391eb61f3fd · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 19, 2026

Filed

Jul 23, 2026

To disclose

26 weeks

Affected

141,230

Linked

10 filings

Confidence

95%

Full breach record for SafetyFirst →2 incidents on file

Safetyfirst Systems, LLC reported a data breach to the Oregon Attorney General. The breach was reported on 2026-07-23. The breach occurred during 1/16/2026 - 1/19/2026. The breach was discovered on 1/19/2026. 141,230 individuals were affected. Notice was sent on 5/21/20266/22/20267/23/2026.

J jump to incidentP pin to compareR raw source

Oregon clock✗ OR AG >45d26 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 26 weeks / 185 days

Jan 16, 2026

Begins

Jan 19, 2026

Discovered

Jul 23, 2026

Filed

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

South Carolina State AGbd_040d0e18b0e6fc0b2026-07-23Verified
New Hampshire State AGbd_440e40e75b8e3bab2026-07-23Verified
Nebraska State AGbd_50b680190ffb752e2026-07-23Verified
Massachusetts State AGbd_60c66a4e1edccb922026-07-23Candidate

Show 5 more filings ↓up to 22d gap

Indiana State AGbd_6e942abcb51b9e102026-07-23Verified
Washington State AGbd_bc745a0679daa31f2026-07-23Verified
California State AGbd_d59ad81fdec3e96e2026-07-23Candidate
Texas State AGbd_dff0e099643dee8d2026-07-23Verified
Illinois State AGbd_03fb70879d50edd32026-07-01 · +22dVerified

Name: SafetyFirst
norm: safetyfirst
Domain: safetyfirst.com

Name: SafetyFirst
norm: safetyfirst
Domain: safetyfirst.com

Discovered: Jan 19, 2026
Breach occurred: Jan 16, 2026 – Jan 19, 2026
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 141,230nationwide
Data types: —
Attack vector: Unknown

Time to disclose: 26 weeks(185 days from discovery to filing)
Compliance flags: OR AG >45d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGJul 1 · first

South Carolina State AG+22d

New Hampshire State AG+22d

Nebraska State AG+22d

Massachusetts State AG+22d

Indiana State AG+22d

Washington State AG+22d

California State AG+22d

Texas State AG+22d

Oregon State AG+22d · this page

Pattern: first filing Jul 1 (IL), last Jul 23 (OR) — a 22-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://justice.oregon.gov/consumer/DataBreach/
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 23, 2026
Raw hash: 4572a2d8e4f3a91980721a1da688dd68765d4fef81f5099e3379c5e5005c6fd9

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entitySafetyFirst

Victim entitySafetyFirst

Incidentdiscovered Jan 19, 2026

ComplianceOR AG >45d

Extraction provenanceno artifact recorded

Source provenancejustice.oregon.gov