HackingEducationEducationStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentHighContained

Bend-La Pine School District

bd_302bb651da4bc6d3 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 25, 2025

Filed

Mar 4, 2025

To disclose

7 days

Affected · nationwide

9,7491 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Bend-La Pine School District →2 incidents on file

Bend-La Pine School District reported a data breach affecting 9,749 individuals, including 1 Maine resident. The incident occurred on December 21, 2024, via third-party administrator Carruth Compliance Consulting. Personal information including SSNs, financial accounts, and driver's licenses was potentially compromised. Notices were sent on February 28, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 25, 2025 → Filed with AG Mar 4, 20257d ✓ ME AG ≤30d7 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 66 days

discovery → filing · 7 days

Dec 21, 2024

Begins

Feb 25, 2025

Discovered

Mar 4, 2025

Filed

vs. sector median

9 wks faster

This filing is one of 5 about the same incident.View merged incident

Part of Carruth Compliance Consulting supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_87185f2e68555b102025-03-04Verified
Oregon State AGbd_bef4cd9438486dff2025-03-04Verified
New Hampshire State AGbd_7cc38104fcb1d97f2025-03-03 · +1dVerified
Indiana State AGbd_35d65eb06b5665782025-02-28 · +4dVerified

Name: Bend-La Pine School District
norm: bend la pine school district
Domain: bend.k12.or.us

Name: Bend-La Pine School District
norm: bend la pine school district
Domain: bend.k12.or.us
Industry: Educationllm

Discovered: Feb 25, 2025
Breach occurred: Dec 21, 2024
Undetected for: 66 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 28, 2025
Affected individuals: 9,749state + nationwide
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Federal Bureau of Investigation (FBI)
Third party: via Carruth Compliance Consulting
Initial access: supply_chain

During the incident: Began investigating the incident
Sought information from Carruth about the Incident
Worked to identify all current and former employees whose personal information was shared with Carruth
Offered complimentary credit monitoring and identity theft protection services through IDX
Changes made: Offered 12 months of credit and CyberScan monitoring
Provided a $1,000,000 insurance reimbursement policy
Provided fully managed identity theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: ME AG ≤30d · 7d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 25, 2025
→ Filed with AG: Mar 4, 2025
7d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 25, 2025 → Filed with AG: Mar 4, 2025	7d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGFeb 28 · first

New Hampshire State AG+3d

Massachusetts State AG+4d

Oregon State AG+4d

Maine State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/fc248fa7-076c-4c51-bdde-987226d8b6f0.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2025
Raw hash: 85b4f497e0bafcce303259b5bcfeb72d5a955186302da263c4237b2847c1e34f

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBend-La Pine School District

Victim entityBend-La Pine School District

Incidentdiscovered Feb 25, 2025

Stated responseBegan investigating the incident

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov