Farmer Brothers Data Breach Notice (Oregon Attorney General): What Was Exposed & What To Do

Organizations across retail, food service, and consumer goods continue to face steady pressure from cyber incidents that expose customer and employee records, often months before the public learns the details. Notices filed with state attorneys general remain one of the clearest windows into these events when companies themselves issue limited public statements.

Farmer Brothers, a coffee and beverage supplier, notified Oregon residents of a data breach in a filing reported to the Oregon Department of Justice on September 09, 2025. The filing places the incident itself on March 06, 2025, and states that 14,470 people were affected. The notice describes the exposed material as personal information. For individuals whose data may have been involved, the gap between the incident date and the formal report underscores why timely monitoring and practical steps matter even when full technical details remain limited.

Breaking down the breach

According to the Oregon Attorney General filing, Farmer Brothers experienced a data breach on March 06, 2025. The company later submitted a breach notice that was reported on September 09, 2025. That notice identifies 14,470 people as affected and characterizes the exposed data as personal information. Public detail beyond those points is limited. The filing does not describe the intrusion method, the systems involved, whether ransomware or another form of unauthorized access was used, or how long any attacker may have remained inside the environment. No threat actor is named in the available record, and no additional counts, file inventories, or dollar figures are provided in the disclosed summary.

The multi-month interval between the stated incident date and the Oregon filing is consistent with many corporate notifications, which often follow internal investigation, legal review, and coordination with regulators before letters or public notices are issued. What is known comes directly from that regulatory notice rather than from independent forensic disclosure.

How a breach like this happens

Incidents that result in notices of this kind typically begin with an initial foothold—commonly a compromised credential, a phishing message that yields remote access, an unpatched internet-facing service, or misuse of a legitimate remote-access tool. Once inside, an attacker may move laterally, locate databases or file shares containing customer or employee records, and copy data for later use or sale. In other cases the goal is encryption and extortion; in still others the data is simply exfiltrated quietly.

Organizations often discover the activity through unusual outbound traffic, endpoint alerts, law-enforcement tips, or the appearance of their data on criminal forums. After containment, companies engage counsel and forensic firms, determine the scope of personal information involved, and prepare the state-by-state notices required by law. None of these general patterns is confirmed for the Farmer Brothers event; they simply describe how comparable personal-information breaches commonly unfold when no specific method has been publicly attributed.

Farmer Brothers and its sector

Farmer Brothers is a long-established supplier of coffee, tea, and related beverage products to restaurants, convenience stores, and other food-service customers across the United States. Companies in this sector routinely maintain records on employees, wholesale buyers, delivery contacts, and sometimes end consumers who participate in loyalty or direct-order programs. Those records can include names, addresses, contact details, and other identifiers needed for payroll, shipping, invoicing, and customer service.

A breach affecting a mid-sized food-and-beverage firm is consequential because the same operational data that keeps supply chains running is also useful to identity thieves and social engineers. Even when the company itself is not a household consumer brand, the volume of personal information it holds can still reach tens of thousands of individuals, as the Oregon notice indicates.

What was likely exposed

The Oregon filing states that personal information was exposed. It does not itemize the precise fields—such as Social Security numbers, driver’s-license data, financial account numbers, or dates of birth—so those specifics remain unconfirmed. Organizations of this type commonly store names, postal and email addresses, phone numbers, employment or payroll identifiers, and business-contact records. Some also retain limited payment or tax-related information for employees and certain commercial accounts.

Because the notice uses the broad category “personal information” without further breakdown, readers should treat any assumption about exact data elements as unverified. The What's Publicly Reported are limited to the category named in the regulatory filing and the count of 14,470 affected individuals.

Why it matters

For the people counted in the notice, exposure of personal information raises concrete risks of targeted phishing, account takeover attempts, and, if richer identifiers were involved, identity fraud. Even basic contact data can be combined with other leaked sets to craft convincing social-engineering messages. The months that may pass between an incident and formal notification give criminals a window in which to test credentials or sell records before victims are alerted.

For Farmer Brothers, the event carries regulatory, reputational, and operational costs: mandatory notices, potential credit-monitoring offers, legal review, and the need to harden systems against recurrence. Customers and partners may also reassess how much data they share. None of these consequences requires assuming negligence; they follow from the simple fact that personal information left the organization’s control.

What to do if you're exposed

If you believe you may be among the 14,470 people referenced in the Oregon notice, start with the basics: review any letter or email you received from the company for the exact data elements it lists and for any offer of credit monitoring. Place a free fraud alert or security freeze with the major credit bureaus if sensitive identifiers could be involved. Treat unexpected messages that reference Farmer Brothers or coffee-industry accounts with caution, and change passwords on related email or wholesale portals, enabling multi-factor authentication where available.

Monitor bank and credit-card statements for unfamiliar activity. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; that check will not confirm or deny involvement in this specific incident, but it can surface other exposures that warrant the same protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.