HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTEMPLOYMENTMediumContained
Klamath County School District
bd_dc66ecae2c951cd0 · schema v1 · pii pii-v1
Full breach record for Klamath County School District →Klamath County School District notified consumers of a data breach involving third-party administrator Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed names, SSNs, financial account info, and potentially driver's license and tax data. The FBI was notified. Affected individuals are offered 12 months of credit monitoring and identity theft protection.
Vermont clock⏱ VT AG >14 bday10 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_dc3d99731956f924Indiana State AGfiled 2025-02-28Verified
- bd_fc3ada64c8b511e2Montana State AGfiled 2025-02-28Candidate
- bd_c6455d7c1f439912Oregon State AGfiled 2025-03-02(2d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-02-28-klamath-county-school-district-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 28, 2025
- Raw hash
- 69bb0aba9a9acb320b4ecf6cece902054335ff522b90dea9b08bd35c1863e963
Reporting entity
- Name
- Klamath County School Districtnorm: klamath county school district
- Domain
- kcsd.k12.or.us
- Industry
- education
Victim entity
- Name
- Klamath County School Districtnorm: klamath county school district
- Domain
- kcsd.k12.or.us
- Industry
- education
Incident
- Discovered
- Dec 21, 2024
- Materiality determined
- Feb 28, 2025
- Notification sent
- Feb 28, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTEMPLOYMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the Federal Bureau of Investigation
- Third party
- via Carruth Compliance Consulting
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 weeks(69 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.