HackingData MishandlingSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHIMediumContained
Canby School District
bd_b3d84967c321ad41 · schema v1 · pii pii-v1
Full breach record for Canby School District →Canby School District notified the Maryland Attorney General of a data security incident involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring around December 21, 2024, potentially exposed personal information of 1 Maryland resident, including names, SSNs, driver's license numbers, financial account info, and medical billing data. Canby notified the FBI, engaged third-party investigators, and offered 12 months of credit monitoring and identity theft protection to the affected individual.
Maryland clock⏱ MD AG >30d10 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376506.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 4, 2025
- Raw hash
- ed4bb796d533f187790d45b62ab129f944cab2e8c37403b1554c4e938ce3b6b6
Reporting entity
- Name
- Constangy, Brooks, Smith & Prophete, LLPnorm: constangy brooks smith prophete
Victim entity
- Name
- Canby School Districtnorm: canby school district
- Domain
- canby.k12.or.us
- Industry
- education
Incident
- Discovered
- Dec 21, 2024
- Materiality determined
- —
- Notification sent
- Feb 28, 2025
- Affected individuals
- 1
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHI
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Notified the Federal Bureau of InvestigationNotified Maryland Attorney General
- Third party
- via Carruth Compliance Consulting
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 weeks(73 days from discovery to filing)
- Compliance flags
- MD AG >30d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.