HackingEducationEducationSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryPIICREDENTIALSFINANCIALPHIIDENTITY_GOVERNMENTMediumContained
Carruth Compliance Consulting
bd_577e4c353bcb43e9 · schema v1 · pii pii-v1
Full breach record for Carruth Compliance Consulting →Klamath County School District (OR) reported a breach at third-party retirement plan administrator Carruth Compliance Consulting. Unauthorized access occurred ~Dec 21, 2024; KCSD notified Jan 13, 2025; affected individuals identified Feb 24, 2025. One Maine resident affected. Data at risk: name, SSN, driver's license, financial accounts, W-2, medical billing, tax filings. IDX identity protection offered for 12 months.
Maine clockDiscovered Feb 24, 2025 → Filed with AG Mar 2, 20256d ✓ ME AG ≤30d6 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 36 about the same incident.View merged incident
Linked disclosures
Why this link?Ransomware claims (1)
- bd_3e00870e56c719fdLeak Siteskirafiled 2025-03-06(4d gap)Verified by operator
Regulatory filings (9) · sorted by filing gap
- bd_016ef578bb378975Vermont State AGfiled 2025-03-05(3d gap)Verified
- bd_494f8474c6709ac2Vermont State AGfiled 2025-03-05(3d gap)Candidate
- bd_cfc24ddcc92ca8dfVermont State AGfiled 2025-03-05(3d gap)Candidate
- bd_3eb5e0b59021f81eMaryland State AGfiled 2025-03-12(10d gap)Verified by operator
Show 5 more filings ↓Show fewer ↑up to 32d gap
- bd_576364560b4ed0e9Vermont State AGfiled 2025-03-12(10d gap)Candidate
- bd_acabaf53ae628c3bVermont State AGfiled 2025-03-12(10d gap)Verified
- bd_b25c36c6190b9c6dMaryland State AGfiled 2025-03-12(10d gap)Verified by operator
- bd_8191768bdf8e7f15Maryland State AGfiled 2025-03-13(11d gap)Verified by operator
- bd_cf90222526710a2cVermont State AGfiled 2025-04-03(32d gap)Verified
Showing first 10 of 35 linked disclosures.
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/57dee51d-4e87-4e22-a415-da2b08e90136.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 2, 2025
- Raw hash
- 201f1847de1bb659c10000e41fb5c867a4b8ce98acb6a5e647b2c34ef16e54cb
Reporting entity
- Name
- Klamath County School Districtnorm: klamath county school district
- Domain
- kcsd.k12.or.us
- Industry
- Education
Victim entity
- Name
- Carruth Compliance Consultingnorm: carruth compliance consulting
- Domain
- ncompliance.com
- Industry
- Professional Services / Retirement Plan Administration
- Industry
- Educationllm
Incident
- Discovered
- Feb 24, 2025
- Materiality determined
- —
- Notification sent
- Feb 28, 2025
- Affected individuals
- 1
- Data types
- PIICREDENTIALSFINANCIALPHIIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- Threat actor
- External
- Regulator citations
- Notified Federal Bureau of Investigation
- Third party
- via Carruth Compliance Consulting
Compliance
- Time to disclose
- 6 days(6 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 6d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 24, 2025→ Filed with AG: Mar 2, 20256d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.