HackingSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTFINANCIALHEALTH_BASICMediumContained
Carruth Compliance Consulting
bd_a8b413dd7869fd4f · schema v1 · pii pii-v1
Full breach record for Carruth Compliance Consulting →Lebanon Community School District 9 (LCSD) reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on or about December 21, 2024, may have exposed personal information of approximately one Maryland resident, including name, SSN, driver's license, financial account info, and medical billing data. LCSD notified the FBI, engaged third-party specialists, and sent notification letters offering 12 months of credit monitoring and identity theft protection.
Maryland clock⏱ MD AG >30d10 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 36 about the same incident.View merged incident
Linked disclosures
Why this link?Ransomware claims (1)
- bd_3e00870e56c719fdLeak Siteskirafiled 2025-03-06(6d gap)Verified by operator
Regulatory filings (9) · sorted by filing gap
- bd_016ef578bb378975Vermont State AGfiled 2025-03-05(5d gap)Verified
- bd_494f8474c6709ac2Vermont State AGfiled 2025-03-05(5d gap)Candidate
- bd_cfc24ddcc92ca8dfVermont State AGfiled 2025-03-05(5d gap)Candidate
- bd_3eb5e0b59021f81eMaryland State AGfiled 2025-03-12(12d gap)Verified by operator
Show 5 more filings ↓Show fewer ↑up to 34d gap
- bd_576364560b4ed0e9Vermont State AGfiled 2025-03-12(12d gap)Candidate
- bd_acabaf53ae628c3bVermont State AGfiled 2025-03-12(12d gap)Verified
- bd_b25c36c6190b9c6dMaryland State AGfiled 2025-03-12(12d gap)Verified by operator
- bd_8191768bdf8e7f15Maryland State AGfiled 2025-03-13(13d gap)Verified by operator
- bd_cf90222526710a2cVermont State AGfiled 2025-04-03(34d gap)Verified
Showing first 10 of 35 linked disclosures.
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376447.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 28, 2025
- Raw hash
- fcc3b39d9ac30d76ec4a90c8a44ed02cc536c2a35290f4045ddf4f1272f26f83
Reporting entity
- Name
- Lebanon Community School District 9norm: lebanon community school district 9
- Domain
- lebanon.k12.or.us
Victim entity
- Name
- Carruth Compliance Consultingnorm: carruth compliance consulting
- Domain
- ncompliance.com
Incident
- Discovered
- Dec 21, 2024
- Materiality determined
- —
- Notification sent
- Feb 28, 2025
- Affected individuals
- 1
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTFINANCIALHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Regulator citations
- Notified the Federal Bureau of InvestigationFiled notification with Maryland Attorney General
- Third party
- via Carruth Compliance Consulting
Compliance
- Time to disclose
- 10 weeks(69 days from discovery to filing)
- Compliance flags
- MD AG >30d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.