Carruth Compliance Consulting

Oregon City School District notified the Maryland AG of a data breach affecting 1 Maryland resident. The breach occurred at third-party vendor Carruth Compliance Consulting on or about Dec 21, 2024. Data exposed included names, SSNs, driver's licenses, financial accounts, and medical billing info. OCSD notified the FBI, engaged specialists, and offered credit monitoring.

Affected (this filing): 1

Junction City School District notified affected individuals of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, exposed personal information including SSNs, financial account numbers, and driver's license numbers. The FBI was notified. The District is offering 12 months of credit monitoring and identity theft protection.

Newberg School District notified Maryland AG of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information (SSNs, driver's licenses, financial/medical data) occurred on Dec 21, 2024. 1 Maryland resident affected. FBI notified. Credit monitoring offered.

Affected (this filing): 1

Lane ESD notified consumers of a data breach involving third-party administrator Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed names, SSNs, financial account info, and potentially driver's licenses and W-2s. Lane ESD offered 12 months of credit monitoring via IDX.

Forest Grove School District reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on or about December 21, 2024, compromised personal information of approximately 2 Maryland residents, including names, SSNs, driver's license numbers, financial account info, and medical billing data. FGSD notified the FBI, engaged forensic specialists, and sent notification letters offering credit monitoring.

Affected (this filing): 2

Newberg School District notified consumers of a data breach affecting its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, involved unauthorized access to personal information including names, SSNs, and financial account data. Newberg offered 12 months of credit monitoring and identity theft protection to affected employees and beneficiaries.

Oregon City School District notified consumers of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, exposed personal information including names, SSNs, financial account numbers, and potentially driver's license and W-2 data. The FBI was notified. Affected individuals were offered credit monitoring services.

Linn-Benton Lincoln ESD notified the Maryland AG of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Personal information of approximately 4 Maryland residents (names, SSNs, driver's licenses, financial account info, medical billing info) may have been acquired without authorization on or about December 21, 2024. Notification letters were sent on February 28, 2025, offering credit monitoring.

Affected (this filing): 4

Lebanon Community School District 9 (LCSD) reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on or about December 21, 2024, may have exposed personal information of approximately one Maryland resident, including name, SSN, driver's license, financial account info, and medical billing data. LCSD notified the FBI, engaged third-party specialists, and sent notification letters offering 12 months of credit monitoring and identity theft protection.

Affected (this filing): 1

Pilot Rock School District 2 notified the Maryland AG of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed personal info (SSN, driver's license, financial accounts, medical billing) of 1 Maryland resident. Carruth engaged forensic specialists and notified the FBI. The District offered 12 months of credit monitoring and identity theft protection to affected individuals.

Affected (this filing): 1

Bethel School District #52 reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on or about December 21, 2024, compromised the names and Social Security numbers of approximately two Maryland residents. Bethel notified the FBI, engaged third-party investigators, and sent notification letters offering 12 months of credit monitoring and identity theft protection services.

Affected (this filing): 2

Central Oregon Community College (COCC) notified the Vermont AG that its third-party administrator, Carruth Compliance Consulting, experienced a data security incident on December 21, 2024. The breach potentially exposed employees' names, SSNs, financial account info, driver's licenses, W-2s, and medical billing data. COCC is offering 12 months of credit monitoring and identity theft protection via IDX to affected individuals.

Sweet Home School District notified consumers of a data breach affecting its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, compromised personal information including names, SSNs, financial account numbers, and potentially driver's license and W-2 data. The FBI was notified. Affected individuals were offered 12 months of credit monitoring and identity theft protection.

Southern Oregon Education Services District notified consumers of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, exposed personal information including SSNs, financial account data, and driver's license numbers. SOESD engaged investigators, notified the FBI, and offered credit monitoring services to affected employees and beneficiaries.

Jefferson School District 14J notified consumers of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, potentially exposed names, SSNs, financial account info, and driver's license numbers of employees and beneficiaries. The FBI was notified, and affected individuals were offered credit monitoring.

Molalla River School District notified Maryland AG of a data breach affecting its third-party administrator, Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed personal info (SSN, driver's license, financial accounts) of 2 Maryland residents. Carruth engaged forensic specialists and notified the FBI. Affected individuals received notification letters and offers for 12 months of credit monitoring and identity theft protection.

Affected (this filing): 2

Lane ESD notified consumers of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, exposed personal information including names, SSNs, financial account numbers, and potentially driver's license and tax data. Lane ESD is offering credit monitoring services to affected individuals.

Springfield Public Schools (Oregon) notified the Maryland AG of a data security incident involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on or about Dec 21, 2024, exposed personal information of approximately 1 Maryland resident, including SSNs, driver's license numbers, financial account info, and medical billing data. Springfield engaged forensic specialists, notified the FBI, and offered credit monitoring services.

Affected (this filing): 1

Lane ESD notified Maryland AG of a data security incident involving its third-party administrator, Carruth Compliance Consulting. Unauthorized access to personal information (SSN, driver's license, financial account, medical billing) occurred on or about Dec 21, 2024. One Maryland resident was affected. Notification sent Feb 28, 2025, with credit monitoring services.

Affected (this filing): 1

Klamath County School District (OR) reported a breach at third-party retirement plan administrator Carruth Compliance Consulting. Unauthorized access occurred ~Dec 21, 2024; KCSD notified Jan 13, 2025; affected individuals identified Feb 24, 2025. One Maine resident affected. Data at risk: name, SSN, driver's license, financial accounts, W-2, medical billing, tax filings. IDX identity protection offered for 12 months.

Affected (this filing): 1

Klamath County School District reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. Personal information of approximately one Maryland resident, including SSN, driver's license, and financial account data, may have been acquired without authorization on December 21, 2024. The FBI was notified, and affected individuals were offered credit monitoring.

Affected (this filing): 1

Lincoln County School District notified the Maryland Attorney General of a data security incident involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, potentially exposed personal information of 5 Maryland residents, including names, SSNs, driver's license numbers, financial account info, and medical billing data. Notifications were sent on February 28, 2025, offering credit monitoring.

Affected (this filing): 5

North Wasco County School District reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. Personal information of approximately 2 Maryland residents, including SSNs and financial data, was acquired without authorization around December 21, 2024. The FBI was notified, and affected individuals received credit monitoring services.

Affected (this filing): 2

West Linn-Wilsonville School District reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. On or about December 21, 2024, unauthorized access occurred, potentially exposing personal information of approximately 9 Maryland residents, including names, SSNs, driver's license numbers, and financial account information. The district notified the FBI, engaged third-party specialists, and sent notifications to affected individuals on February 28, 2025, offering credit monitoring services.

Affected (this filing): 9

Centennial School District reported a data security incident involving its third-party administrator, Carruth Compliance Consulting, affecting 1 Maryland resident. The breach, occurring around December 21, 2024, exposed personal information including names, SSNs, driver's license numbers, and financial account data. Carruth engaged third-party specialists and notified the FBI. Centennial notified the affected individual and offered 12 months of credit monitoring and identity theft protection services via IDX.

Affected (this filing): 1

Bend-La Pine School District notified that third-party administrator Carruth Compliance Consulting experienced a data security incident on Dec 21, 2024. Personal information of employees and beneficiaries, including names, SSNs, and financial account info, may have been acquired without authorization. The FBI was notified. Affected individuals are offered 12 months of credit monitoring.

West Linn-Wilsonville School District notified consumers of a data breach affecting its third-party administrator, Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed names, SSNs, financial account info, and potentially driver's licenses and W-2s. The FBI was notified. Affected individuals were offered 12 months of credit monitoring and identity theft protection.

Multnomah Education Service District (ESD) notified affected individuals of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, exposed personal information including names, SSNs, financial account numbers, and driver's license numbers of current and former employees and their beneficiaries. The FBI was notified. The ESD is offering 12 months of credit monitoring and identity theft protection services.

Reynolds School District #7 notified consumers of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on December 21, 2024, exposed personal information including SSNs, financial account data, and driver's license numbers of current and former employees. Carruth notified the FBI. The District is offering 12 months of credit monitoring and identity theft protection via IDX.

Northwest Regional Education Service District (OR) notified consumers of a data breach affecting its third-party administrator, Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed names, SSNs, financial account info, and potentially driver's licenses and W-2s of current/former employees and beneficiaries. Carruth engaged FBI and forensic specialists. NWRESD offered 12 months of credit monitoring via IDX.

Northwest Regional Education Service District notified the Maryland AG of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring around Dec 21, 2024, exposed personal info (SSNs, driver's licenses, financial accounts) of approximately 3 Maryland residents. Carruth engaged forensic specialists and notified the FBI. Northwest Regional offered credit monitoring and identity protection services to affected individuals.

Affected (this filing): 3

Tillamook School District 9 reported a data security incident involving its third-party administrator, Carruth Compliance Consulting. Personal information of 1 Maryland resident was potentially acquired without authorization on or about December 21, 2024. Data involved included names, SSNs, driver's license numbers, financial account info, and medical billing info. Tillamook notified the FBI, engaged third-party investigators, and sent notifications offering credit monitoring.

Affected (this filing): 1

Port Orford-Langlois SD 2CJ notified consumers of a data breach involving its third-party administrator, Carruth Compliance Consulting. The incident, occurring on Dec 21, 2024, exposed names, SSNs, financial account info, and potentially driver's license and tax data for employees and beneficiaries. Carruth engaged FBI and forensic specialists. Port Orford offered 12 months of credit monitoring via IDX.