MalwareEducationProfessional ServicesEducationRansomwareData EncryptedCustomer Data InvolvedIdentity (basic)LowContained

Association of California School Administrators

bd_56449ff5993e7e50 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 24, 2023

Filed

May 22, 2024

To disclose

34 weeks

Affected

Not disclosed

Linked

7 filings

Confidence

65%

Full breach record for Association of California School Administrators →

Association of California School Administrators (ACSA) experienced a ransomware incident between September 23-24, 2023, where an unauthorized actor encrypted files and accessed systems. ACSA became aware of the suspicious activity on September 24, 2023. The investigation determined that names and potentially other personal information were impacted. ACSA engaged third-party cybersecurity specialists, conducted a manual review of affected files, and is offering credit monitoring and identity protection services to affected individuals. The incident has been contained.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 24, 2023 → Notified May 22, 2024241d ✗ CA 60-day late34 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 34 weeks / 241 days

Sep 23, 2023

Begins

Sep 24, 2023

Discovered

May 22, 2024

Filed

vs. sector median

+24 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Vermont State AGbd_05f7dcc0bd140b832024-05-22Verified
Indiana State AGbd_40b3f13958d534622024-05-22Verified
New Hampshire State AGbd_4d8b08bc7963ab0f2024-05-22Verified
Massachusetts State AGbd_52eeace4e171e4542024-05-22Verified

Show 2 more filings ↓

Maine State AGbd_724586f861f6bfc42024-05-22Candidate
Montana State AGbd_fc9882e474ad594b2024-05-22Candidate

Name: Association of California School Administrators
norm: association of california school administrators

Name: Association of California School Administrators
norm: association of california school administrators
Industry: EducationllmProfessional Servicesllm

Discovered: Sep 24, 2023
Breach occurred: Sep 23, 2023 – Sep 24, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: May 22, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: External

During the incident: Launched an investigation with the assistance of third-party cybersecurity specialists
Conducted a comprehensive, programmatic and manual review to identify whether the files contained personal information
Offering credit monitoring and identity protection services through IDX for 12/24 months, at no cost
Changes made: Assessed and further strengthened the security of our systems and computer environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 34 weeks(241 days from discovery to filing)
Compliance flags: CA 60-day late · 241d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 24, 2023
→ Notified: May 22, 2024
241d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 24, 2023 → Notified: May 22, 2024	241d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Vermont State AGMay 22 · first

Indiana State AGMay 22 · first

New Hampshire State AGMay 22 · first

Massachusetts State AGMay 22 · first

Maine State AGMay 22 · first

Montana State AGMay 22 · first

California State AGMay 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-585791
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 22, 2024
Raw hash: 77739ec48b7c96cf1ae973de614dc073d02e9061b2ef62984780fb24aed35522

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAssociation of California School Administrators

Victim entityAssociation of California School Administrators

Incidentdiscovered Sep 24, 2023

Stated responseLaunched an investigation with the assistance of third-party cybersecurity specialists

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov