DisclosureLens
HackingEducationEducationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedCredentialsIdentity (basic)LowContained

Saddleback Valley Unified School District

bd_43b182a717b48fd9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 27, 2020

Filed

Jun 24, 2020

To disclose

8 weeks

Affected

Not disclosed

Confidence

65%
Full breach record for Saddleback Valley Unified School District →

Saddleback Valley Unified School District notified families of unauthorized access to its Aeries Student Information System on November 4, 2019. The district learned of the potential breach on April 27, 2020, via its vendor Aeries. Affected data included parent/student login information, physical addresses, email addresses, and encrypted passwords. No SSNs or financial data were stored in the system. The district reset all parent passwords and implemented stricter password guidelines. Law enforcement was notified and arrests were made.

California clockDiscovered Apr 27, 2020 → Notified Jun 24, 202058d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 175 days
discovery → filing · 8 weeks / 58 days

Nov 4, 2019

Begins

Apr 27, 2020

Discovered

Jun 24, 2020

Filed

vs. sector median

+1 wks slower

Part of Aeries supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.