AccidentalEducationEducationMisconfigurationVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedPIICredentialsPHIIdentity (basic)Government IDHealth (basic)EducationMinorAuthenticationMediumResolved

Alliance College-Ready Public Schools

bd_2fedcde1cf119966 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Oct 23, 2017

To disclose

—

Affected

Not disclosed

Confidence

83%

Full breach record for Alliance College-Ready Public Schools →4 incidents on file

Alliance College-Ready Public Schools notified students and parents of a data breach involving Schoolzilla Inc., a third-party school data platform. A security researcher discovered a vulnerability in the Schoolzilla system on approximately April 4, 2017. The researcher accessed partial student records including credentials, PII, health information, and academic data. Schoolzilla fixed the vulnerability and verified the researcher deleted all accessed data.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 4, 2017

Begins

Oct 23, 2017

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Alliance College-Ready Public Schools
norm: alliance college ready public schools
Domain: laalliance.org

Name: Alliance College-Ready Public Schools
norm: alliance college ready public schools
Domain: laalliance.org
Industry: Educationllm

Discovered: —
Breach occurred: Apr 4, 2017 – Apr 5, 2017
Materiality determined: —
Notification sent: Jun 30, 2017
Affected individuals: Not disclosed
Data types: PIICredentialsPHIIdentity (basic)Government IDHealth (basic)EducationMinorAuthentication
Data elements: Date of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Third party: via Schoolzilla Inc.
Initial access: exploit_public_facing

During the incident: Schoolzilla reconfigured its systems to fix the vulnerability
Schoolzilla changed passwords
Schoolzilla ensured that the downloaded data has been deleted
Schoolzilla is working with third-party security experts to help augment its existing data security practices
Alliance urges parents and students to change students' email passwords (and any other security credential if applicable) to protect the student's online accounts
Changes made: Schoolzilla is working with third-party security experts to look for opportunities to increase its current security defenses
Schoolzilla is working to run a 'Red Team Exercise,' a drill where internet and data security experts engage in an all-out attempt to gain access to a system so the vendor can fully test and challenge its cybersecurity defenses
Alliance will continue to be in communication with Schoolzilla to monitor its efforts to maintain the security of Alliance student data stored on Schoolzilla's data platform
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-102921
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 23, 2017
Raw hash: f2e5a56874af9c494c86ec458ce888e5ab95a9bbeac05c741dd40df577ac0c09

Reporting entityAlliance College-Ready Public Schools

Victim entityAlliance College-Ready Public Schools

IncidentMisconfiguration

Stated responseSchoolzilla reconfigured its systems to fix the vulnerability

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov