HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICMediumContained

Multnomah Education Service District

bd_673619f7abec2fcf · schema v1 · pii pii-v1

Full breach record for Multnomah Education Service District →

Multnomah Education Service District (Oregon) notified the Maryland Attorney General of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring around December 21, 2024, exposed personal information of approximately 5 Maryland residents, including names, SSNs, driver's license numbers, financial account info, and medical billing data. Carruth engaged third-party specialists and notified the FBI. Multnomah notified affected individuals on February 28, 2025, offering 12 months of credit monitoring and identity theft protection via IDX.

Maryland clock⏱ MD AG >30d10 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5 affectedView incident

Source provenance

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376503.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 4, 2025
Raw hash: c6e5908c1658b3599ebc9805150ca989048d124a9b181d008b7c77818adb1ecc

Reporting entity

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Victim entity

Name: Multnomah Education Service District
norm: multnomah education service district
Domain: multnomahesd.org

Incident

Discovered: Dec 21, 2024
Materiality determined: —
Notification sent: Feb 28, 2025
Affected individuals: 5
Data types: IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified the Maryland Attorney General's Office
Third party: via Carruth Compliance Consulting
Initial access: supply_chain

Compliance

Time to disclose: 10 weeks(73 days from discovery to filing)
Compliance flags: MD AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Extraction provenance

Status: No extraction artifact recorded for this disclosure.