The Washington State Office of the Attorney General disclosed a data breach affecting Made In Oregon, occurring between September 1, 2020, and February 28, 2021. The incident exposed sensitive personal and financial information of approximately 12,890 individuals, including 840 Washington residents. Compromised data included names, billing/shipping addresses, email addresses, and credit card details, raising significant concerns over financial fraud and identity theft risks. The breach highlights vulnerabilities in the company’s data protection measures, potentially leading to unauthorized transactions, phishing attacks targeting affected customers, and reputational damage. While the exact method of compromise (e.g., phishing, system exploitation) was not specified, the exposure of payment card data aligns with patterns seen in financially motivated cyberattacks. Customers may face fraudulent charges, while the company could incur regulatory penalties, legal costs, and erosion of trust. The scale and nature of the leaked data suggest a high-risk scenario for both individuals and the organization, though no evidence of ransomware or broader systemic disruption was reported.

The California Office of the Attorney General reported a data breach involving Made In Oregon on October 13, 2020. The breach occurred between February 3, 2020, and August 28, 2020, potentially affecting customers' names, billing addresses, shipping addresses, email addresses, and credit card information. The number of individuals affected is currently unknown.