HackingSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedPIIIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIALHEALTH_BASICMediumContained
Bend-La Pine School District
bd_7cc38104fcb1d97f · schema v1 · pii pii-v1
Full breach record for Bend-La Pine School District →Bend-La Pine School District notified the NH Attorney General of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about December 21, 2024. The district identified 4 affected New Hampshire residents. Data types included PII, driver's license numbers, W-2s, and medical billing info. The district engaged third-party investigators, notified the FBI, and offered credit monitoring services.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_3864316e5f19597aMontana State AGfiled 2025-03-03Candidate
- bd_302bb651da4bc6d3Maine State AGfiled 2025-03-04(1d gap)Verified
- bd_bef4cd9438486dffOregon State AGfiled 2025-03-04(1d gap)Verified
- bd_35d65eb06b566578Indiana State AGfiled 2025-02-28(3d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/bend-la-pine-school-district-carruth-compliance-consulting-20250303.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 3, 2025
- Raw hash
- c0ac192a93b618edb8e9b802afc6b1dbb6425caba4a3693541846013522071ac
Reporting entity
- Name
- Bend-La Pine School Districtnorm: bend la pine school district
- Domain
- bend.k12.or.us
Victim entity
- Name
- Bend-La Pine School Districtnorm: bend la pine school district
- Domain
- bend.k12.or.us
Incident
- Discovered
- Jan 13, 2025
- Materiality determined
- —
- Notification sent
- Feb 28, 2025
- Affected individuals
- 4
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIALHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- Partner
- Regulator citations
- Notified the Federal Bureau of InvestigationNotified New Hampshire Attorney General
- Third party
- via Carruth Compliance Consulting
- Initial access
- supply_chain
Compliance
- Time to disclose
- 7 weeks(49 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.