Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Breach topic
No spam. Unsubscribe anytime.
District to notify nearly 2,439 current and former employees after Carruth retirement vendor data breach
Summary
Estacada will notify 2,439 current and former employees after its retirement plan administrator, Carruth, reported an unauthorized data access affecting names, Social Security numbers and other personal information.
Estacada School District staff told the board that a third-party retirement plan administrator, Carruth, reported a data security incident that may have exposed personal information for current and former employees.
Lisa (human resources coordinator) told the board Carruth experienced unauthorized access to personal data and informed the district on Jan. 13. The district engaged its insurance carrier (PACE) and outside counsel (Costanji Group) and is working with IDX to provide complimentary credit monitoring and identity-protection services. Lisa said district records show 2,439 people from 1999 to the present may need notification; attorneys are preparing mailed notices and an FAQ and the district must also notify the Oregon attorney general under state law.
District staff emphasized the breach was against Carruth92s systems, not the district92s. The notices will include a QR code and a call center number for IDX. The credit-monitoring service is being offered for one year; the district and outside counsel are working out opt-out and post-trial communications so individuals are not unintentionally rolled into paid services after the complimentary period.
Board members asked about timing and letter appearance; staff said the letter will use district text on the envelope so recipients open it and stressed that the legal team is drafting the text. The district also thanked HR coordinator Lisa and Director of Technology Christy Cheshire for leading the response and communications with partners.
