Valsoft Corporation Inc. d/b/a AllTrust Data Breach Notice (Oregon Attorney General): What Was Exposed & What To Do

Valsoft Corporation Inc., doing business as AllTrust, notified Oregon residents of a data breach in a filing reported to the Oregon Department of Justice on February 27, 2025. According to that notice, the incident affected 98,123 people and involved personal information. Public detail beyond the filing remains limited, yet the scale of the reported population makes clear why the disclosure matters to individuals whose records may have been involved.

The notice itself is the primary public record of the event. It establishes that AllTrust informed state authorities and affected Oregon residents after discovering the incident, but it does not elaborate on technical method, exact timeline of unauthorized access, or a full inventory of every data element. What is known so far is therefore confined to the organization’s own regulatory filing.

Inside the incident

On February 27, 2025, Valsoft Corporation Inc. d/b/a AllTrust submitted a data-breach notice to the Oregon Department of Justice. The filing states that 98,123 individuals were affected and that the exposed material consisted of personal information as described in the breach notification. No further public breakdown of the intrusion path, duration of access, or forensic findings has been included in the available record.

Because the disclosure is framed as a notice to Oregon residents, the confirmed geographic scope of the filing is Oregon. Whether residents of other states were also impacted is not stated in the facts provided. Likewise, the precise window in which the unauthorized activity occurred, the systems involved, and any containment steps taken after discovery remain undisclosed in the public summary. The core facts rest solely on the organization’s report: a breach occurred, personal information was involved, and tens of thousands of people were notified through the Oregon channel.

How a breach like this happens

Incidents that lead to notices of this kind typically begin when an unauthorized party gains access to systems or files that store customer or client records. Common entry points across many organizations include compromised credentials, phishing messages that harvest login details, unpatched software vulnerabilities, or misconfigured cloud storage. Once inside, the actor may copy databases, export spreadsheets, or exfiltrate backup files containing names, contact details, and other personal data.

After exfiltration, the data may be held for extortion, offered for sale, or simply left exposed. Organizations then conduct internal investigations, determine the scope of affected records, and issue legally required notices to regulators and individuals. None of these general patterns identifies a specific method or threat group in the AllTrust case; the filing does not attribute the incident to any named actor or describe the technical vector. The description above is background only, illustrating how personal-information breaches commonly unfold rather than asserting what occurred here.

Who is Valsoft Corporation Inc. d/b/a AllTrust?

Valsoft Corporation Inc. operates under the trade name AllTrust. Public knowledge of the broader Valsoft group indicates it acquires and operates specialized software and service businesses across multiple vertical markets. Entities operating under such structures often handle customer accounts, billing records, and supporting personal data necessary to deliver software or related services. AllTrust, as the d/b/a name used in the Oregon filing, is the entity that issued the breach notice.

A breach at an organization that maintains personal information is consequential because the data can be reused for identity-related fraud, targeted phishing, or account takeover attempts. Even when the precise business line is not exhaustively detailed in a state filing, the presence of personal information in the affected systems means the incident reaches beyond internal IT concerns and into the daily lives of the people whose records were stored.

What data was at risk

The breach notification names the exposed data as personal information. No more granular list—such as Social Security numbers, financial account details, driver’s license numbers, or medical data—appears in the facts supplied. Therefore the exact data elements remain unconfirmed beyond the broad category of personal information.

Organizations that provide software or related services commonly hold names, addresses, email addresses, phone numbers, account identifiers, and sometimes payment or identification details. Those categories are typical for the sector; they are not confirmed contents of this particular incident. Readers should treat only the phrase “personal information” as established by the notice and regard any finer inventory as undisclosed.

The real-world impact

For the 98,123 people referenced in the Oregon filing, the practical risk is that their personal information could be misused if it has left the organization’s control. Common downstream effects include unwanted contact attempts, fraudulent account openings, or social-engineering attacks that leverage accurate personal details to appear legitimate. The severity depends on which specific fields were present—an unknown factor here—and on whether the data has circulated further.

For AllTrust and Valsoft, the incident carries regulatory, operational, and reputational consequences. State notice laws require timely reporting and individual notification; failure to meet those obligations can produce additional scrutiny. Internally, the organization must investigate, secure systems, and support affected individuals. None of these outcomes implies established negligence; they are the ordinary consequences that follow a confirmed personal-information breach of this reported size.

What to do if you're exposed

If you believe you may be among those notified, begin by reading any letter or email you received from AllTrust carefully and retaining it for your records. Place a fraud alert or security freeze with the major credit bureaus if you are concerned about new-account fraud. Monitor financial and online accounts for unfamiliar activity, and be skeptical of unexpected messages that reference the breach or request sensitive information. Change passwords on related services and enable multi-factor authentication where available.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach datasets. Doing so provides an additional data point but does not replace official notices or credit monitoring. Stay alert for further communications from AllTrust or regulators, and treat any unsolicited offer of “breach remediation” services with caution until you verify its legitimacy.

AICompiled with AI assistance from public sources and published under our editorial standards.