Carruth Compliance Consulting breach exposed data on tens of thousands of school staff

Carruth Compliance Consulting, an Oregon firm that administers 403(b) and 457(b) retirement savings plans for public school districts and non-profit employers, was breached in December 2024. The company detected suspicious activity on its systems on December 21, 2024, and a later forensic review found that an intruder had access between December 19 and December 26.

Files taken in the intrusion held names, Social Security numbers and financial account details. For some individuals the material also included driver's license numbers, W-2 forms, medical billing records and tax filings. Beneficiary information supplied to the firm was affected as well.

A ransomware crew calling itself Skira listed Carruth on its leak site and said it had taken data belonging to 36 public schools. SecurityWeek reported that the group claimed roughly 469 GB of databases, source code and personal records. Skira was new at the time, with Carruth among the first handful of victims it named.

Carruth began notifying victims on January 13, 2025 and offered credit monitoring and identity restoration. Because the firm said it could not identify affected individuals itself, districts ran their own reviews, most finishing by late February. The Record counted more than 40,000 affected school employees across states including Maine, Oregon, California, Illinois, New York and Pennsylvania as of March 6, 2025, and said the real figure was likely higher. Comparitech, tallying district notices, put the total above 110,000 across 36 schools. Class action suits followed, and at least one district said it would stop using the firm.