HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Bethel School District
bd_d43d1653288e7f50 · schema v1 · pii pii-v1
Full breach record for Bethel School District →Bethel School District #52 notified consumers of a data breach involving third-party administrator Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed names and government IDs (SSNs) of employees and beneficiaries. Carruth engaged the FBI. The District offered 12 months of credit monitoring via IDX.
Vermont clock⏱ VT AG >14 bday10 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-02-28-bethel-school-district-52-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 28, 2025
- Raw hash
- f75615011062d90594423c56c1f6a40c8303bdd2237ec53e262b668453316c09
Reporting entity
- Name
- Bethel School Districtnorm: bethel school district
- Domain
- bethel.k12.or.us
Victim entity
- Name
- Bethel School Districtnorm: bethel school district
- Domain
- bethel.k12.or.us
Incident
- Discovered
- Dec 21, 2024
- Materiality determined
- Feb 28, 2025
- Notification sent
- Feb 28, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- External
- Regulator citations
- Notified Federal Bureau of Investigation (FBI)
- Third party
- via Carruth Compliance Consulting
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 weeks(69 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.