HackingEducationEducationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)MediumContained

Rockland BOCES

bd_0a9fff7b87f1b587 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 7, 2023

Filed

May 19, 2026

To disclose

—

Affected

3state residents only

Confidence

67%

Full breach record for Rockland BOCES →

Rockland BOCES notified the Maryland Attorney General of a data security incident affecting approximately 3 Maryland residents. On December 7, 2023, the organization detected unusual activity in an employee's email account. An investigation determined that personal information, including names, Social Security numbers, driver's license numbers, and treatment/diagnosis information, may have been accessed. Notification was sent to affected individuals in November 2024. Identity protection services were provided.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 7, 2023

Discovered

May 19, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: Rockland BOCES
norm: rockland boces

Name: Rockland BOCES
norm: rockland boces
Industry: Educationllm

Discovered: Dec 7, 2023
Materiality determined: —
Notification sent: Nov 11, 2024
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Regulator citations: Notified Maryland Attorney General

During the incident: Took measures to secure our network
Engaged cybersecurity experts to assist with this process
Engaged a third party to conduct a comprehensive review of all affected information
Implemented additional safeguards to help ensure the security of its systems
Providing those whose Social Security number was involved with identity protection services through Experian
Established a toll-free call center through Experian to answer questions about the incident
Changes made: Implemented additional security measures to protect our digital environment and minimize the likelihood of future incidents
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376130.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 19, 2026
Raw hash: 2a3d1f5599e6eb5ae9923a3a85e990ffc08bb56df347e9eed409453043f5fab2

Reporting entityRockland BOCES

Victim entityRockland BOCES

Incidentdiscovered Dec 7, 2023

Stated responseTook measures to secure our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov