HackingEducationEducationVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedDownstream VictimsN-DayPatch Available Not AppliedIdentity (basic)CredentialsLowContained

San Bernardino City Unified School District

bd_076a6033d47c43a0 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 2, 2020

To disclose

—

Affected

Not disclosed

Confidence

82%

Full breach record for San Bernardino City Unified School District →

San Bernardino City Unified School District notified parents and guardians that Aeries Software, its third-party Student Information System provider, disclosed in April 2020 that an unauthorized individual exploited a vulnerability in the Aeries software in late November 2019. The breach potentially exposed parent and student names, home addresses, phone numbers, email addresses, and hashed passwords. Aeries patched the vulnerability and law enforcement is involved.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 1, 2019

Begins

Jun 2, 2020

Filed

Part of Aeries supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: San Bernardino City Unified School District
norm: san bernardino city unified school district
Domain: sbcusd.com

Name: San Bernardino City Unified School District
norm: san bernardino city unified school district
Domain: sbcusd.com
Industry: Educationllm

Discovered: —
Breach occurred: Nov 1, 2019 – Nov 30, 2019
Materiality determined: —
Notification sent: May 28, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Third party: via Aeries Software
Initial access: exploit_public_facing

During the incident: Aeries and law enforcement launched an investigation
Aeries has installed the necessary software patch to remedy the vulnerability
SBCUSD will be implementing a mandatory password policy for all parent and student portal accounts
Changes made: Aeries has installed the necessary software patch to remedy the vulnerability that allowed the unauthorized individual to access our Aeries system
SBCUSD and Aeries Software are reviewing our existing policies and procedures to mitigate any risk associated with this incident and to better prevent future incidents
SBCUSD will be implementing a mandatory password change policy
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190582
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 2, 2020
Raw hash: 2553d21a09bf72453b71a248e1a4d0d4e3445242fadc89c56ae1ee01c1269285

Reporting entitySan Bernardino City Unified School District

Victim entitySan Bernardino City Unified School District

IncidentUnauthorized Access

Stated responseAeries and law enforcement launched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov