PhysicalEducationEducationTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

David Douglas School District

bd_19b5a68c37b7e15c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 29, 2023

Filed

Feb 24, 2023

To disclose

26 days

Affected

36state residents only

Linked

5 filings

Confidence

64%

Full breach record for David Douglas School District →4 incidents on file

David Douglas School District notified individuals of a data breach resulting from the burglary of an office and theft of a physical hard drive on January 29, 2023. The drive contained PII of employees (2011-2014 hires), including names, addresses, DOBs, and SSNs. DDSD reported the crime to police, enhanced security, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 26 days

Jan 29, 2023

Begins

Jan 29, 2023

Discovered

Feb 24, 2023

Filed

vs. sector median

5 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_241d1e6c4916961e2023-02-24Verified
Oregon State AGbd_2453c17079f733d22023-02-24Verified
New Hampshire State AGbd_25bdcdaae997d8d92023-02-24Verified
Massachusetts State AGbd_dd6f547c920331b92023-02-24Verified

Name: David Douglas School District
norm: david douglas school district
Domain: ddouglas.k12.or.us

Name: David Douglas School District
norm: david douglas school district
Domain: ddouglas.k12.or.us
Industry: Educationllm

Discovered: Jan 29, 2023
Breach occurred: Jan 29, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 24, 2023
Affected individuals: 36state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to the Portland Police Bureau

During the incident: Initiated an investigation into the contents of the hard drive
Took steps to identify any personal information contained on the stolen hard drive
Implemented additional security features to reduce the risk of a similar incident occurring in the future
Reported the incident to the Portland Police Bureau
Offering complimentary credit monitoring and identity protection services through IDX
Changes made: Implemented additional security features to reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGFeb 24 · first

Oregon State AGFeb 24 · first

New Hampshire State AGFeb 24 · first

Massachusetts State AGFeb 24 · first

Montana State AGFeb 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-97.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 24, 2023
Raw hash: 4b0cbf8c9f7f72c3858a25bfd8b5ae391e5aa068cf1bd2fe0472484fc36a9a37

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityDavid Douglas School District

Victim entityDavid Douglas School District

Incidentdiscovered Jan 29, 2023

Stated responseInitiated an investigation into the contents of the hard drive

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov