Social EngineeringEducationEducationPhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)LowResolved

Carmel Clay Schools

bd_326882847ef340da · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 24, 2021

Filed

Sep 20, 2021

To disclose

30 weeks

Affected

6state residents only

Linked

6 filings

Confidence

65%

Full breach record for Carmel Clay Schools →

Carmel Clay Schools notified affected individuals of a security incident where employee email accounts were accessed without authorization between Feb 15-24, 2021. The breach involved names and other personal data. CCS reset passwords, engaged forensic specialists, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

discovery → filing · 30 weeks / 208 days

Feb 15, 2021

Begins

Feb 24, 2021

Discovered

Sep 20, 2021

Filed

vs. sector median

+20 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_164d87a90d880e5b2021-09-20Verified
Idaho State AGbd_9a5ae29e5b38cd4a2021-09-20Verified
Maine State AGbd_ba3c4ed795a5ecb22021-09-20Verified by operator
Indiana State AGbd_d4c458eccfee6b692021-09-20Verified

Show 1 more filing ↓up to 18d gap

New Hampshire State AGbd_bc3873a53cb99d6c2021-09-02 · +18dVerified

Name: Carmel Clay Schools
norm: carmel clay schools

Name: Carmel Clay Schools
norm: carmel clay schools
Industry: Educationllm

Discovered: Feb 24, 2021
Breach occurred: Feb 15, 2021 – Feb 24, 2021
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 31, 2021
Affected individuals: 6state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Initiated a password reset to all CCS staff accounts
Launched an investigation with the assistance of third-party forensics specialists
Undertook a diligent and comprehensive review of the entire contents of the email accounts involved
Added further technical safeguards to our environment
Offering complimentary access to credit monitoring and identity restoration services through Equifax
Changes made: Added further technical safeguards to our environment
Increased the security of our environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(208 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGSep 2 · first

Massachusetts State AG+18d

Idaho State AG+18d

Maine State AG+18d

Indiana State AG+18d

Montana State AG+18d · this page

Pattern: first filing Sep 2 (NH), last Sep 20 (MT) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-14.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 20, 2021
Raw hash: 808fbe0ffe770d71b8dafbdf8917a622fe9c9a0f4614827993a1e811f33434a1

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCarmel Clay Schools

Victim entityCarmel Clay Schools

Incidentdiscovered Feb 24, 2021

Stated responseInitiated a password reset to all CCS staff accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov