HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTEMPLOYMENTMediumContained
Corvallis School District 509J
bd_dbf282eb9abc4882 · schema v1 · pii pii-v1
Full breach record for Corvallis School District 509J →Corvallis School District 509J notified individuals of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, potentially exposed names, SSNs, financial account info, and driver's license numbers. The FBI was notified. The District offered 12 months of credit monitoring and identity protection services.
Vermont clock⏱ VT AG >14 bday10 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_813a223a9bc72754Maryland State AGfiled 2025-02-28Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-02-28-corvallis-school-district-509j-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 28, 2025
- Raw hash
- 56c29a4d0092b77a1885e1512a2e0bcaa0f9158e418a7c9a7dcad12e144f6d8d
Reporting entity
- Name
- Corvallis School District 509Jnorm: corvallis school district 509j
- Domain
- csd509j.net
Victim entity
- Name
- Corvallis School District 509Jnorm: corvallis school district 509j
- Domain
- csd509j.net
Incident
- Discovered
- Dec 21, 2024
- Materiality determined
- —
- Notification sent
- Feb 28, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTEMPLOYMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the Federal Bureau of Investigation
- Third party
- via Carruth Compliance Consulting
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 weeks(69 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.