HackingEducationEducationStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryPIIIDENTITY_GOVERNMENTMediumResolved
Lewis County School District
bd_3fcaaf8f708abb84 · schema v1 · pii pii-v1
Full breach record for Lewis County School District →Lewis County School District (Hohenwald, TN) notified 2 Maine residents of a data event originating at PowerSchool, a third-party student information system vendor. Between December 19–28, 2024, an unknown actor accessed and downloaded student and teacher data from PowerSchool's systems. LCSD learned of the impact on February 14, 2025. Affected data includes name and Social Security number. Total individuals affected: 1,969. PowerSchool provided 24-month Experian credit monitoring at no cost.
Maine clockDiscovered Feb 14, 2025 → Filed with AG Mar 12, 202526d ✓ ME AG ≤30d26 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_81a0d4025c3c24dbIndiana State AGfiled 2025-03-12Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c567cc65-7bb0-4c40-a675-36c5ee5c5b17.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 12, 2025
- Raw hash
- f7577888b4422c8f6809c093b681b158c420ea14d7ab4262ed15c70f9c8a0324
Reporting entity
- Name
- Lewis County School Districtnorm: lewis county school district
- Industry
- Education
Victim entity
- Name
- Lewis County School Districtnorm: lewis county school district
- Industry
- Education
- Industry
- Educationllm
Incident
- Discovered
- Feb 14, 2025
- Materiality determined
- —
- Notification sent
- Mar 12, 2025
- Affected individuals
- 2
- Data types
- PIIIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
- Threat actor
- External
- Third party
- via PowerSchool
- Initial access
- supply_chain
Compliance
- Time to disclose
- 26 days(26 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 26d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 14, 2025→ Filed with AG: Mar 12, 202526d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.