HackingEducationGovernmentEducationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryCredentialsIdentity (basic)LowActive

El Dorado County Office of Education

bd_1ea603441b9f0380 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 17, 2020

To disclose

—

Affected

Not disclosed

Confidence

75%

Full breach record for El Dorado County Office of Education →

El Dorado County Office of Education notified parents of Charter Alternative Program of unauthorized access to the Aeries Student Information System on approximately November 4, 2019. The breach exposed parent and student login information, password hashes, physical addresses, and email addresses. Notification was sent on May 19, 2020. Local and federal law enforcement were notified and charges were filed against one individual. Passwords were reset and stricter password policies were enforced.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 4, 2019

Begins

Jun 17, 2020

Filed

Part of Aeries supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: El Dorado County Office of Education
norm: el dorado county office of education
Domain: edcoe.org

Name: El Dorado County Office of Education
norm: el dorado county office of education
Domain: edcoe.org
Industry: EducationllmGovernmentllm

Discovered: —
Breach occurred: Nov 4, 2019 – Nov 6, 2019
Materiality determined: —
Notification sent: May 19, 2020
Affected individuals: Not disclosed
Data types: CredentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1110 Brute ForceT1530 Data from Cloud Storage Object
Threat actor: External
Regulator citations: Local and federal law enforcement officials were notified of the incidentCharges were filed on a single individual
Third party: via Aeries Software

During the incident: Resetting the account passwords for all Charter parents out of an abundance of caution
Local and federal law enforcement officials were notified of the incident, charges were filed on a single individual, and the investigation is continuing
Aeries Software took action to ensure the security of the system
Changes made: Enforcing stricter password security guidelines (minimum 8 characters, require a special character, require letters and numbers, require upper and lower case)
Aeries Software adopted new security protocols and additional technical measures to prevent future incidents
Will continue to work closely with Aeries Software to ensure data remains secure
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-191009
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 17, 2020
Raw hash: fa2654a587e581669a20b620a9f2220c705f517e6c72702351a2219e257a02bf

Reporting entityEl Dorado County Office of Education

Victim entityEl Dorado County Office of Education

IncidentUnauthorized Access

Stated responseResetting the account passwords for all Charter parents out of an abundance of caution

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov