Cascade School District wants to make current staff and previously employed staff aware of a data breach of a vendor we use for staff retirement saving plans and payroll. We, like you, are frustrated that another outside vendor has had a breach like the one from PowerSchool reported last week. Both of these issues are outside of our control.
We have not received any more information from PowerSchool. They continue to believe the stolen data was deleted. The way Cascade set up our use of PowerSchool was helpful, with no passwords or full social security numbers in the system.
The new breach which we just received word about this week is from Carruth Compliance Consulting (Carruth). Carruth provides third-party administrative services to public school districts and non-profit organizations for their 403(b) and 457(b) retirement savings plans and payroll for many Oregon school districts, including Cascade.
Carruth discovered suspicious activity on their computer systems. An investigation revealed that unauthorized access to Carruth’s network occurred in late December 2024, resulting in the compromise of sensitive employee data for Carruth’s clients, including Cascade.
We know receiving this information may be stressful. Please know we are working with Carruth, its insurers and others to understand the full scope of the incident, to ensure all affected employees will be directly notified, and to ensure Carruth is taking appropriate steps to mitigate the impact on our employees.
Look below for free credit monitoring provided by Carruth (which will also protect you from the PowerSchool breach.) Please review the frequently asked questions below.
Was I Impacted?
This data breach potentially impacts all employees who have been employed by Cascade between 2008 and today. To be on the safe side, we are assuming that all Cascade employees between 2008 and now have been impacted by this breach, and we encourage everyone to take the steps listed below.
What Information Was Compromised?
The compromised information at Carruth may include employees’ name, Social Security number, and financial account information. In some cases, it could also include driver's license number, and for those who may have applied for a hardship loan it could include W-2 information, medical billing information (but not medical records), and tax filings.
What Is Cascade Doing?
We are working with Carruth to understand the full scope of the breach and to ensure they are taking appropriate steps to mitigate the impact on our employees. We will continue to update you with the latest information as it becomes available. Additionally, we are working on transitioning our payroll service to a different subcontractor, hopefully having this completed by the February payroll period.
What Should I Do?
-
Enroll in Credit Monitoring and Identity Restoration Services: Carruth is offering free credit monitoring and identity restoration services through IDX. To enroll, please call IDX at (877) 720-7895. Select “Customer Service” and ask for data protection. We have requested that Carruth directly notify each affected employee, but you can enroll in the services before receiving an “official” notification letter.
-
Monitor Your Accounts: Regularly review your bank accounts, credit card statements, and other financial accounts for any suspicious activity. If you see anything unusual, report it to your financial institution immediately.
-
Check Your Credit Reports: You are entitled to one free credit report annually from each of the three major credit reporting bureaus (Equifax, Experian, and TransUnion). Visit Annual Credit Report website or call 1-877-322-8228 to order your free reports.
-
Consider Placing a Fraud Alert or Credit Freeze on your Credit Report: You can place a fraud alert or credit freeze on your credit report to help protect yourself from identity theft. See details below.
-
Report Any Suspicious Activity: If you suspect you are a victim of identity theft, report it to the Federal Trade Commission (FTC) at FTC Identity Theft website or call 1-877-ID-THEFT (1-877-438-4338). You should also file a police report.
Fraud Alerts and Credit Freezes
-
Fraud Alert: A fraud alert notifies creditors to verify your identity before issuing new credit. You can place an initial fraud alert (lasting one year) or an extended fraud alert (lasting seven years) if you are already a victim of identity theft.
-
Credit Freeze: A credit freeze prevents credit bureaus from releasing your credit report without your explicit consent. This makes it harder for identity thieves to open accounts in your name.
How to Place a Fraud Alert or Credit Freeze
Contact the Three Major Credit Reporting Bureaus:
Who to Contact for More Information?
If you have questions regarding this event, call Carruth Compliance Consulting at 877-720-7895, Monday through Friday, from 6 a.m. to 6 p.m. PST.
As a district, we don’t have further information to share but will keep staff updated as we learn more about what this means moving forward.
Link to Carruth Data Security Event Notice