Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Breach topic
No spam. Unsubscribe anytime.
District notifies staff of third‑party retirement vendor security incident
Summary
Business and fiscal services informed the board that Cruz Compliance Consulting — a third‑party retirement services vendor — experienced suspicious activity in late December; the vendor investigation concluded Jan. 13 and the district posted an FAQ and vendor contact information for affected employees.
During the business and fiscal services report, staff notified the board of a data security incident involving the district’s third‑party retirement-account provider, Cruz Compliance Consulting.
Staff said the vendor reported suspicious activity detected around Dec. 21 and that an investigation (noted in the meeting as Dec. 19–26) concluded on Jan. 13. The vendor provides 403(b) services for multiple Oregon districts, the presenter said, and the incident involved unauthorized acquisition of sensitive client information. The district has posted an FAQ on its human-resources web page, staff emailed affected employees and the vendor provided a hotline for questions.
Board members asked for clarity about the relationship to PERS and were told the vendor’s services are separate from PERS. Staff said the district will continue to communicate next steps and recommended protections available to staff. "Cruise Compliance Consulting also has information on their website. And then, you can call them during normal business hours, and there's an 877 number that's included in that web page," the presenter said during the report.
