Carruth Data Incident Update

Carruth Notice of Data Security Event

Dear Colleagues,

Cybersecurity incidents are becoming an unfortunate fact of life. On January 13, 2025, we learned that Carruth Compliance Consulting, the third-party administrator of Multnomah ESD’s 403(b) and 457(b) retirement plans, experienced a data security incident on December 21, 2024 (the “Carruth Incident” or “Incident”). 

Carruth Incident Affected Information: The affected information at Carruth may include employee and beneficiary Form W-2 Wage and Tax Statement information (names, Social Security numbers, mailing addresses and compensation information), dates of birth, financial account information, email addresses, driver’s license numbers and medical billing information (but not medical records). The Carruth Incident potentially affects all current and former employees of Multnomah ESD and their beneficiaries dating back to 2008.

Note: The exact data which may have been affected is unknown. Carruth is unable to provide specific details on which MESD employees', if any, data may have been impacted. For those who were affected the data that was accessible varied based on the kind of information which was shared directly with Carruth. Carruth had access to some details such as name, dates of birth, financial account information, email addresses for every MESD employee.  For others, such as those who have taken a loan against their retirement accounts, other information has been provided by the employee directly to Carruth. In those instances, Carruth may have maintained information such as driver’s license numbers and medical billing information (but not medical records).

Carruth Response to Incident: Carruth reported that upon learning of the Incident, they began working with third-party specialists to investigate the activity, and then notified the Federal Bureau of Investigation. Carruth also engaged a sub-contractor to handle processing of information coming in from its clients. For the foreseeable future, no further retirement account transactions from Multnomah ESD employees will be processed by Carruth. . 

Identity Protection Service: Carruth is offering free credit monitoring and identity restoration services to all individuals who may have been affected by the Incident through IDX, a company which provides identity theft protection. ITo enroll in these services, call 877.720.7895. We also encourage you to monitor your retirement accounts and consider obtaining a free credit report and placing an initial or extended fraud alert and/or a credit freeze on your credit file at no cost. More information about the Carruth Incident and all of these steps can be found at ncompliance.com.

For past messages shared with you visit: https://www.multnomahesd.org/public-notices-agency-updates

We know receiving this information may be stressful. Please know we are working with Carruth, its insurers and others to understand the full scope of the incident, to ensure all affected employees will be directly notified, and to ensure Carruth is taking appropriate steps to mitigate the impact on our employees.