Carruth Compliance Consulting

Port Orford-Langlois SD 2CJ notified consumers of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed names, SSNs, financial account info, and potentially driver's license and tax data for employees and beneficiaries. Carruth engaged FBI and forensic specialists. Port Orford offered 12 months of credit monitoring via IDX.

Tillamook School District 9 reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. Personal information of 1 Maryland resident was potentially acquired without authorization on or about December 21, 2024. Data involved included names, SSNs, driver's license numbers, financial account info, and medical billing info. Tillamook notified the FBI, engaged third-party investigators, and sent notifications offering credit monitoring.

Gresham-Barlow School District notified the Maryland Attorney General of a data security incident involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, potentially exposed personal information of 1 Maryland resident, including names, SSNs, driver's license numbers, financial account info, and medical billing data. Gresham-Barlow notified the FBI, engaged third-party investigators, and offered credit monitoring services to affected individuals.

Reynolds School District #7 notified consumers of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, exposed personal information including SSNs, financial account data, and driver's license numbers of current and former employees. Carruth notified the FBI. The District is offering 12 months of credit monitoring and identity theft protection via IDX.

North Clackamas School District notified the NH AG of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about Dec 21, 2024. North Clackamas was notified on Jan 13, 2025. Approximately 4 NH residents were affected. The district offered credit monitoring services.

Northwest Regional Education Service District (OR) notified consumers of a data breach affecting its third-party administrator, Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed names, SSNs, financial account info, and potentially driver's licenses and W-2s of current/former employees and beneficiaries. Carruth engaged FBI and forensic specialists. NWRESD offered 12 months of credit monitoring via IDX.

Northwest Regional Education Service District notified the Maryland AG of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring around Dec 21, 2024, exposed personal info (SSNs, driver's licenses, financial accounts) of approximately 3 Maryland residents. Carruth engaged forensic specialists and notified the FBI. Northwest Regional offered credit monitoring and identity protection services to affected individuals.

David Douglas School District notified the NH AG of a third-party data breach involving Carruth Compliance Consulting. Unauthorized access to personal information (PII, SSNs, W-2s, medical billing) occurred on or about Dec 21, 2024. The district was notified on Jan 13, 2025. 3 NH residents affected. FBI notified. Credit monitoring offered.

Carruth Compliance Consulting is a company dedicated to consulting on compliance challenges related to Tax-Advantaged Benefit Program administration. It specializes in the administration of 403(b) and 457(b) retirement plans. The company helps employers and financial institutions navigate complex tax laws and compliance regulations relating to benefit plans, providing compliance consulting, plan administration, and ongoing compliance support.

Bend-La Pine School District notified that third-party administrator Carruth Compliance Consulting experienced a data security incident on Dec 21, 2024. Personal information of employees and beneficiaries, including names, SSNs, and financial account info, may have been acquired without authorization. The FBI was notified. Affected individuals are offered 12 months of credit monitoring.

West Linn-Wilsonville School District notified consumers of a data breach affecting its third-party administrator, Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed names, SSNs, financial account info, and potentially driver's licenses and W-2s. The FBI was notified. Affected individuals were offered 12 months of credit monitoring and identity theft protection.

Multnomah Education Service District (ESD) notified affected individuals of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, exposed personal information including names, SSNs, financial account numbers, and driver's license numbers of current and former employees and their beneficiaries. The FBI was notified. The ESD is offering 12 months of credit monitoring and identity theft protection services.

West Linn-Wilsonville School District reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. On or about December 21, 2024, unauthorized access occurred, potentially exposing personal information of approximately 9 Maryland residents, including names, SSNs, driver's license numbers, and financial account information. The district notified the FBI, engaged third-party specialists, and sent notifications to affected individuals on February 28, 2025, offering credit monitoring services.

Centennial School District reported a data security incident involving its third-party administrator, Carruth Compliance Consulting, affecting 1 Maryland resident. The breach, occurring around December 21, 2024, exposed personal information including names, SSNs, driver's license numbers, and financial account data. Carruth engaged third-party specialists and notified the FBI. Centennial notified the affected individual and offered 12 months of credit monitoring and identity theft protection services via IDX.

Multnomah Education Service District reported a third-party data breach involving its vendor, Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about December 21, 2024. Multnomah was notified on January 13, 2025, and notified the FBI. Approximately 6 New Hampshire residents were affected. Credit monitoring services were offered.

Lincoln County School District (Oregon) notified the NH AG of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about Dec 21, 2024. The district notified the FBI and offered credit monitoring to affected employees.

Jefferson School District (Oregon) notified the New Hampshire Attorney General of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about December 21, 2024. The incident affected one New Hampshire resident. Jefferson School District notified the FBI, engaged third-party specialists, and sent notification letters offering credit monitoring and identity theft protection services.

Klamath County School District (OR) reported a breach at third-party retirement plan administrator Carruth Compliance Consulting. Unauthorized access occurred ~Dec 21, 2024; KCSD notified Jan 13, 2025; affected individuals identified Feb 24, 2025. One Maine resident affected. Data at risk: name, SSN, driver's license, financial accounts, W-2, medical billing, tax filings. IDX identity protection offered for 12 months.

Klamath County School District reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. Personal information of approximately one Maryland resident, including SSN, driver's license, and financial account data, may have been acquired without authorization on December 21, 2024. The FBI was notified, and affected individuals were offered credit monitoring.

Lincoln County School District notified the Maryland Attorney General of a data security incident involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, potentially exposed personal information of 5 Maryland residents, including names, SSNs, driver's license numbers, financial account info, and medical billing data. Notifications were sent on February 28, 2025, offering credit monitoring.

North Wasco County School District reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. Personal information of approximately 2 Maryland residents, including SSNs and financial data, was acquired without authorization around December 21, 2024. The FBI was notified, and affected individuals received credit monitoring services.

Springfield Public Schools (Oregon) notified the Maryland AG of a data security incident involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on or about Dec 21, 2024, exposed personal information of approximately 1 Maryland resident, including SSNs, driver's license numbers, financial account info, and medical billing data. Springfield engaged forensic specialists, notified the FBI, and offered credit monitoring services.

Lane ESD notified Maryland AG of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information (SSN, driver's license, financial account, medical billing) occurred on or about Dec 21, 2024. One Maryland resident was affected. Notification sent Feb 28, 2025, with credit monitoring services.

Hillsboro School District 1J notified the NH Attorney General of a data security incident involving third-party administrator Carruth Compliance Consulting. Unauthorized access to personal information of current and former employees occurred on or about December 21, 2024. The district discovered the incident on January 13, 2025. Affected data likely includes PII and government IDs. Credit monitoring services are being offered.

Oregon City School District notified the Maryland AG of a data breach affecting 1 Maryland resident. The breach occurred at third-party vendor Carruth Compliance Consulting on or about Dec 21, 2024. Data exposed included names, SSNs, driver's licenses, financial accounts, and medical billing info. OCSD notified the FBI, engaged specialists, and offered credit monitoring.