HackingRetail & ConsumerRetailVulnerability ExploitTargetedCustomer Data InvolvedPIIIdentity (basic)Financial accountFinancial credentialsLowContained

Made In Oregon

bd_780ad110f3a85777 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 16, 2021

To disclose

—

Affected

34state residents only

Linked

7 filings

Confidence

66%

Full breach record for Made In Oregon →3 incidents on file

Made In Oregon notified Montana residents of a data breach occurring between September 2020 and March 2021. Unauthorized access to customer data including names, addresses, and credit card info was possible. The company engaged forensic consultants, modified its website, and offered two years of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 1, 2020

Begins

Jun 16, 2021

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_7efe2ddfcbdd679b2021-06-18 · +2dVerified
Indiana State AGbd_01d62431247fb74c2021-06-22 · +6dVerified
New Hampshire State AGbd_81dd9834f8db446b2021-06-22 · +6dVerified
Washington State AGbd_fb58f1d5247467d22021-06-22 · +6dVerified

Show 2 more filings ↓up to 35d gap

South Carolina State AGbd_ba30aa9f4043b8e62021-06-23 · +7dVerified
Oregon State AGbd_7d61036037d4cf672021-07-21 · +35dVerified

Name: Made In Oregon
norm: made in oregon
Domain: madeinoregon.com

Name: Made In Oregon
norm: made in oregon
Domain: madeinoregon.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Sep 1, 2020 – Mar 31, 2021
Materiality determined: —
Notification sent: Sep 30, 2021
Affected individuals: 34state-resident count only
Data types: PIIIdentity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Working with law enforcement
Initial access: exploit_public_facing

During the incident: Working with consultants in computer forensics
Conducting a thorough review of the potentially affected data
Modified our website so that it no longer accepts any personal information
Deploying a completely new website using different software
Moving to a new website hosting company
Working with law enforcement
Offering free access to Experian IdentityWorks for two years
Changes made: Deploying a completely new website using different software
Moving to a new website hosting company
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGJun 16 · first · this page

California State AG+2d

Indiana State AG+6d

New Hampshire State AG+6d

Washington State AG+6d

South Carolina State AG+7d

Oregon State AG+35d

Pattern: first filing Jun 16 (MT), last Jul 21 (OR) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/a-notif-28.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 16, 2021
Raw hash: c5efd2a2bc88b00b2340aa0c72ff6f733c0fe64cbc8291cd7f971942cf592f43

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMade In Oregon

Victim entityMade In Oregon

IncidentUnauthorized Access

Stated responseWorking with consultants in computer forensics

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov