HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTEMPLOYMENTHEALTH_BASICMediumContained
Carruth Compliance Consulting
bd_cf90222526710a2c · schema v1 · pii pii-v1
Full breach record for Carruth Compliance Consulting →Port Orford-Langlois SD 2CJ notified consumers of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed names, SSNs, financial account info, and potentially driver's license and tax data for employees and beneficiaries. Carruth engaged FBI and forensic specialists. Port Orford offered 12 months of credit monitoring via IDX.
Vermont clock✗ VT AG >45 bday15 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 36 about the same incident.View merged incident
Linked disclosures
Why this link?Ransomware claims (1)
- bd_3e00870e56c719fdLeak Siteskirafiled 2025-03-06(28d gap)Verified by operator
Regulatory filings (9) · sorted by filing gap
- bd_8191768bdf8e7f15Maryland State AGfiled 2025-03-13(21d gap)Verified by operator
- bd_3eb5e0b59021f81eMaryland State AGfiled 2025-03-12(22d gap)Verified by operator
- bd_576364560b4ed0e9Vermont State AGfiled 2025-03-12(22d gap)Candidate
- bd_acabaf53ae628c3bVermont State AGfiled 2025-03-12(22d gap)Verified
Show 5 more filings ↓Show fewer ↑up to 30d gap
- bd_b25c36c6190b9c6dMaryland State AGfiled 2025-03-12(22d gap)Verified by operator
- bd_016ef578bb378975Vermont State AGfiled 2025-03-05(29d gap)Verified
- bd_494f8474c6709ac2Vermont State AGfiled 2025-03-05(29d gap)Candidate
- bd_cfc24ddcc92ca8dfVermont State AGfiled 2025-03-05(29d gap)Candidate
- bd_8676910bc60e096eMaryland State AGfiled 2025-03-04(30d gap)Verified by operator
Showing first 10 of 35 linked disclosures.
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-04-03-port-orford-langlois-sd-2cj-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 3, 2025
- Raw hash
- ba6dd3f7b8b626191d7a5f302de234b87ecd6b704d84afc5b408a4ba80ca5cd1
Reporting entity
- Name
- Port Orford-Langlois SD 2CJnorm: port orford langlois sd 2cj
- Domain
- 2cj.com
Victim entity
- Name
- Carruth Compliance Consultingnorm: carruth compliance consulting
- Domain
- ncompliance.com
Incident
- Discovered
- Dec 21, 2024
- Materiality determined
- —
- Notification sent
- Apr 3, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTEMPLOYMENTHEALTH_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the Federal Bureau of Investigation
- Third party
- via Carruth Compliance Consulting
- Initial access
- supply_chain
Compliance
- Time to disclose
- 15 weeks(103 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.