HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICMediumContained
Hillsboro School District 1J
bd_0a0f70bcd5b65afc · schema v1 · pii pii-v1
Full breach record for Hillsboro School District 1J →Hillsboro School District 1J notified the Maryland AG of a data breach involving its third-party administrator, Carruth Compliance Consulting. Personal information of approximately 5 Maryland residents (including SSNs, driver's licenses, and medical billing info) was acquired without authorization around Dec 21, 2024. The district engaged investigators, notified the FBI, and offered credit monitoring to affected individuals.
Maryland clock⏱ MD AG >30d10 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5 affectedView incident
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376449.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 28, 2025
- Raw hash
- 4e12649b525e659bf02371e7a52e77f0db37e2f26b3f2a4323686a0e4f6a8852
Reporting entity
- Name
- Hillsboro School District 1Jnorm: hillsboro school district 1j
- Domain
- hsd.k12.or.us
Victim entity
- Name
- Hillsboro School District 1Jnorm: hillsboro school district 1j
- Domain
- hsd.k12.or.us
Incident
- Discovered
- Dec 21, 2024
- Materiality determined
- Feb 28, 2025
- Notification sent
- Feb 28, 2025
- Affected individuals
- 5
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Notified Maryland Attorney General's OfficeNotified the Federal Bureau of Investigation
- Third party
- via Carruth Compliance Consulting
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 weeks(69 days from discovery to filing)
- Compliance flags
- MD AG >30d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.