HackingEducationEducationCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

Merced Union High School District

bd_31994b0baba5a140 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Aug 12, 2025

Filed

Aug 17, 2026

To disclose

12 months

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Merced Union High School District →2 incidents on file

Merced Union High School District detected unauthorized network activity on August 12, 2025. The incident potentially exposed names, dates of birth, Social Security numbers, and some health-related information. The district secured the compromise, engaged third-party experts, and notified law enforcement. Affected individuals are offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 months / 370 days

Aug 12, 2025

Discovered

Aug 17, 2026

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_f1a4b306e96291472026-08-14 · +3dVerified

Name: Merced Union High School District
norm: merced union high school district

Name: Merced Union High School District
norm: merced union high school district
Industry: Educationllm

Discovered: Aug 12, 2025
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unknown
Threat actor: External

During the incident: Secured and remediated the compromise
Engaged additional third-party experts
Commenced an investigation
Notified law enforcement regarding this incident
Providing access to free Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score through Cyberscout
Providing proactive fraud assistance
Changes made: Continuously enhancing systems’ security to prevent a similar event from occurring in the future
Focused on continuous awareness training and assessment of our data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(370 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGAug 14 · first

California State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-628399
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2026
Raw hash: e12dcb2a125849601daca63c3b136703433799d66a672ca679332484b53cb159

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMerced Union High School District

Victim entityMerced Union High School District

Incidentdiscovered Aug 12, 2025

Stated responseSecured and remediated the compromise

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov