HackingSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTOTHERMediumContained
Willamette Education Service District
bd_ebc1819608b97adc · schema v1 · pii pii-v1
Full breach record for Willamette Education Service District →Willamette Education Service District notified the Maryland AG of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring around Dec 21, 2024, exposed personal info (SSNs, driver's licenses, financial accounts) of employees. 1 Maryland resident affected. Carruth engaged investigators and notified the FBI. Willamette offered credit monitoring via IDX.
Maryland clock⏱ MD AG >30d12 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376540.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 12, 2025
- Raw hash
- 8297a58876440bd63bddaaf840a8a0bb6fc70fdb94f250d3e6ea77c86db7021d
Reporting entity
- Name
- Constangy, Brooks, Smith & Prophete, LLPnorm: constangy brooks smith prophete
Victim entity
- Name
- Willamette Education Service Districtnorm: willamette education service district
- Domain
- wesd.org
Incident
- Discovered
- Dec 21, 2024
- Materiality determined
- —
- Notification sent
- Mar 12, 2025
- Affected individuals
- 1
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTOTHER
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Maryland Attorney General's Office
- Third party
- via Carruth Compliance Consulting
Compliance
- Time to disclose
- 12 weeks(81 days from discovery to filing)
- Compliance flags
- MD AG >30d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.