HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountLowContained

Made In Oregon

bd_ba30aa9f4043b8e6 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 23, 2021

To disclose

—

Affected

34state residents only

Linked

7 filings

Confidence

64%

Full breach record for Made In Oregon →3 incidents on file

Made in Oregon notified customers that between September 2020 and February 2021, an unauthorized party may have accessed personal information submitted via their website. Affected data included names, addresses, email addresses, and credit card information. The company engaged forensic consultants, modified its website, and offered two years of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 1, 2020

Begins

Jun 23, 2021

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_01d62431247fb74c2021-06-22 · +1dVerified
New Hampshire State AGbd_81dd9834f8db446b2021-06-22 · +1dVerified
Washington State AGbd_fb58f1d5247467d22021-06-22 · +1dVerified
California State AGbd_7efe2ddfcbdd679b2021-06-18 · +5dVerified

Show 2 more filings ↓up to 28d gap

Montana State AGbd_780ad110f3a857772021-06-16 · +7dCandidate
Oregon State AGbd_7d61036037d4cf672021-07-21 · +28dVerified

Name: Made In Oregon
norm: made in oregon
Domain: madeinoregon.com

Name: Made In Oregon
norm: made in oregon
Domain: madeinoregon.com
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Sep 1, 2020 – Feb 28, 2021
Materiality determined: —
Notification sent: Jun 30, 2021
Affected individuals: 34state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Working with law enforcement
Initial access: exploit_public_facing

During the incident: Working with consultants in computer forensics
Conducting a thorough review of the potentially affected data
Modified our website so that it no longer accepts any personal information
Deploying a completely new website using different software
Moving to a new website hosting company
Working with law enforcement
Offering free access to Experian IdentityWorks for two years
Changes made: Deploying a completely new website using different software running at a new website hosting company
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Montana State AGJun 16 · first

California State AG+2d

Indiana State AG+6d

New Hampshire State AG+6d

Washington State AG+6d

South Carolina State AG+7d · this page

Oregon State AG+35d

Pattern: first filing Jun 16 (MT), last Jul 21 (OR) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/MadeInOregon.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 23, 2021
Raw hash: 94b8c5c0d7e9fb9f8288c952c2d31824a11827fc3bec5f93e1ac1e855b58d644

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMade In Oregon

Victim entityMade In Oregon

IncidentUnauthorized Access

Stated responseWorking with consultants in computer forensics

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov