Portland-area school employees impacted by data breach

PORTLAND, Ore. (KOIN) — Multiple school districts in Oregon have been impacted by a data breach that happened with a third-party retirement account administrator, officials announced.

The notification of the data breach was posted on the website of the Tigard-based Carruth Compliance Consulting, a company that handles the retirement savings accounts for employees with a number of Oregon school districts, including Portland Public Schools, Beaverton School District and Hillsboro School District, among others.

According to their website, CCC said they identified "suspicious activity" on Dec. 21. The company hired a third-party specialist to determine what happened. It was discovered systems on CC's network were accessed "without authorization" between Dec. 19-26.

CCC said they as soon as they found out about the breach, they immediately took steps to investigate, including notifying the FBI. They also offered individuals access to credit monitoring and identity restoration services for free.

CCC serves as a third-party administrator for school districts and non-profit organizations to handle their 403(b) and 457(b) retirement savings accounts.

KOIN 6 News has confirmed a number of local school districts that have been using Carruth and may have been impacted, including North Clackamas School District, Parkrose School District, Reynolds School District, Gresham-Barlow School District and Salem-Keizer Public Schools.

Evergreen Public Schools confirmed to KOIN 6 they do not use Carruth and they have not been impacted. Vancouver Public Schools also told KOIN 6 their district does not use Carruth.

KOIN 6 also reached out to the following school districts about whether they use Carruth but we have not heard back: Lake Oswego School District and Tigard-Tualatin School District.

Officials with the Beaverton School District wanted to spread the word that while it's easy to reach current employees about the breach, it can be harder to notify former employees. They said the breach may have impacted "anyone who's worked for BSD since 2009" and that other districts may face "a similar challenge."

More information about what to do if you're a victim of identity theft can be found on the Federal Trade Commission's website.