Alvin Independent School District
bd_619624d5039f9e51 · schema v1 · pii pii-v1
Full breach record for Alvin Independent School District →Press / market disclosure — not a breach-notification filing
A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage — verify against the source.
Texas school district notifies 47K students and staff of data breach that leaked SSNs, credit cards, and more - Comparitech. Alvin Independent School District: Alvin Independent School District suffered a data breach in June 2024, which compromised the personal information of 47,606 individuals, including Social Security numbers, credit card numbers, and medical information. The Fog ransomware gang claimed responsibility for the attack. The incident was reported on the Texas Attorney General's website on May 2, 2025. Linked ransomware group: fog.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jun 13, 2024
Press report
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Attack → press
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Ransomware claims (1)
- Leak Sitefogbd_76e2355ecbb8b09e2024-07-04 · +21dCandidate
Regulatory filings (1) · sorted by filing gap
- Texas State AGbd_e085be73056103bc2025-06-30 · +382dVerified by operator
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- incident type + narrative only (may be machine-translated)
- discovery date
- materiality
- affected count
- data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
fog
According to ransomware.live, Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.