Carruth Data Breach

Carruth Compliance Consulting (Carruth) is the third-party administrator that handles 403(b) retirement savings plan for many Oregon school districts, including Oregon City School District.

The week of Jan. 13, 2025, we learned that Carruth Compliance Consulting, the third-party administrator of Oregon City School District’s 403(b) and 457(b) retirement savings plans, discovered suspicious activity on its computer systems. An investigation revealed that unauthorized access to Carruth’s network occurred in late December 2024, resulting in the compromise of sensitive employee data for Carruth’s clients, including OCSD.

Carruth immediately began working with third-party specialists to investigate the activity, and then notified the Federal Bureau of Investigation. The company also immediately engaged a sub-contractor to handle processing of information coming in from its clients. For the foreseeable future, no further retirement account transactions from Oregon City School District employees will be processed by Carruth.

Notice of Data Security Event

Frequently Asked Questions

Am I impacted

This data breach potentially impacts all employees who have been employed by OCSD between 2008 and today. To be on the safe side, we are assuming that all OCSD employees between 2008 and now have been impacted by this breach, and we encourage everyone to take the steps listed below.

What information was Compromised?

The compromised information at Carruth may include employees’ name, Social Security number, and financial account information. In some cases, it could also include driver's license number, and for those who may have applied for a hardship loan it could include W-2 information, medical billing information (but not medical records), and tax filings.

What is OCSD doing?

  • We are working with Carruth to understand the full scope of the breach and to ensure they are taking appropriate steps to mitigate the impact on our employees.

  • We are providing this FAQ and will continue to update it with the latest information as it becomes available.

What should i do?

  • Enroll in Credit Monitoring and Identity Restoration Services: Carruth is offering free credit monitoring and identity restoration services through IDX. To enroll, please call IDX at (877) 720-7895.

  • Monitor Your Accounts: Regularly review your bank accounts, credit card statements, and other financial accounts for any suspicious activity. If you see anything unusual, report it to your financial institution immediately.

  • Check Your Credit Reports: You are entitled to one free credit report annually from each of the three major credit reporting bureaus (Equifax, Experian, and TransUnion). Visit www.annualcreditreport.com or call 1-877-322-8228 to order your free reports.  

  • Consider Placing a Fraud Alert or Credit Freeze on your Credit Report: You can place a fraud alert or credit freeze on your credit report to help protect yourself from identity theft. See details below.

  • Report Any Suspicious Activity: If you suspect you are a victim of identity theft, report it to the Federal Trade Commission (FTC) at www.identitytheft.gov or 1-877-ID-THEFT (1-877-438-4338). You should also file a police report.

fraud Alert and Credit Freezes

  • Fraud Alert: A fraud alert notifies creditors to verify your identity before issuing new credit. You can place an initial fraud alert (lasting one year) or an extended fraud alert (lasting seven years) if you are already a victim of identity theft.

  • Credit Freeze: A credit freeze prevents credit bureaus from releasing your credit report without your explicit consent. This makes it harder for identity thieves to open accounts in your name.

How to place a Fraud alert or credit freeze, contact the three major credit reporting bureaus:

Additional Resources: