Clustered 11 filings across 2 jurisdictions · filing window Jan 13, 2025 → Mar 12, 2025. View entity profile → Other incidents for this victim →
incident inc_9f1611570c844841 · merge_method deterministic · confidence 100%
Discovered → first regulatory filing
Range of discovered_at dates across filings
NH OR
Time between earliest and latest filing
Not recorded for this incident
Leak precedence · Materiality delta · SEC filing delay — no leak-site claim in this cluster; no SEC 8-K in this cluster.
all State AG
per-filing reported counts
State AGs report only their own residents; bars show per-filing counts.
Earliest sighting first · deep chronology in Litigation Timeline
11 filings across 2 jurisdictions · Jan 13, 2025 – Mar 12, 2025 · 3 milestones
Dec 19, 2024 → Dec 26, 2024
When the intrusion reportedly occurred, per the linked filings
Dec 21, 2024
Reported by OREGON AG filing
Jan 13, 2025
Reported by NEW HAMPSHIRE AG filings
Carruth Compliance Consulting reported a data breach to the Oregon Attorney General. The breach was reported on 2025-01-13. The breach occurred during 12/19/2024 - 12/26/2024. The breach was discovered on 12/21/2024. Notice was sent on 1/13/2025.
About this clustering
DisclosureLens links filings into incidents through layered matchers: deterministic rules (same source document, multistate filings of one breach, tight-window same-victim pairs), a weighted-similarity scorer for cross-source candidates, and an operator review queue for everything uncertain. Each link records its own method and confidence — shown per filing in the timeline below. The system defaults to NOT merging when uncertain, because a false merge (collapsing two unrelated breaches) is more harmful than a false split (showing related filings separately); uncertain pairs route to human review instead of auto-merging. Filing summaries shown in the timeline are AI-generated extracts — verify each against its linked source.
Hillsboro School District 1J notified the NH Attorney General of a data security incident involving third-party administrator Carruth Compliance Consulting. Unauthorized access to personal information of current and former employees occurred on or about December 21, 2024. The district discovered the incident on January 13, 2025. Affected data likely includes PII and government IDs. Credit monitoring services are being offered.
Carruth Compliance Consulting, a third-party administrator for Corvallis School District 509J retirement plans, experienced a data security incident on or about December 21, 2024. The breach potentially exposed personal information of approximately 1 New Hampshire resident. Carruth engaged third-party specialists and notified the FBI. The District notified the NH Attorney General on February 28, 2025, and offered complimentary credit monitoring and identity theft protection services to affected individuals.
Affected (this filing): 1
Rainier School District notified the NH Attorney General of a data security incident involving third-party administrator Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about Dec 21, 2024. The district notified the FBI and engaged third-party specialists. Affected individuals are offered credit monitoring.
Lane Community College notified the NH Attorney General of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about Dec 21, 2024. Lane CC was notified on Jan 13, 2025. Approximately 1 NH resident was affected. Notifications were sent on Feb 28, 2025, offering credit monitoring.
Affected (this filing): 1
Chemeketa Community College notified the NH Attorney General of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information (including SSNs, driver's licenses, W-2s, and medical billing info) occurred on or about Dec 21, 2024. Chemeketa CC was notified on Jan 13, 2025, and offered credit monitoring to affected employees.
Multnomah Education Service District reported a third-party data breach involving its vendor, Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about December 21, 2024. Multnomah was notified on January 13, 2025, and notified the FBI. Approximately 6 New Hampshire residents were affected. Credit monitoring services were offered.
Affected (this filing): 6
Lincoln County School District (Oregon) notified the NH AG of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about Dec 21, 2024. The district notified the FBI and offered credit monitoring to affected employees.
Jefferson School District (Oregon) notified the New Hampshire Attorney General of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about December 21, 2024. The incident affected one New Hampshire resident. Jefferson School District notified the FBI, engaged third-party specialists, and sent notification letters offering credit monitoring and identity theft protection services.
Affected (this filing): 1
North Clackamas School District notified the NH AG of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information occurred on or about Dec 21, 2024. North Clackamas was notified on Jan 13, 2025. Approximately 4 NH residents were affected. The district offered credit monitoring services.
Affected (this filing): 4
David Douglas School District notified the NH AG of a third-party data breach involving Carruth Compliance Consulting. Unauthorized access to personal information (PII, SSNs, W-2s, medical billing) occurred on or about Dec 21, 2024. The district was notified on Jan 13, 2025. 3 NH residents affected. FBI notified. Credit monitoring offered.
Affected (this filing): 3