HackingTechnologyEducationInformationCustomer Data InvolvedIdentity (basic)CredentialsLowContained

Aeries

bd_733c1d55cc7f4e75 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2019

Filed

May 21, 2020

To disclose

29 weeks

Affected

Not disclosed

Confidence

67%

Full breach record for Aeries →

Aeries Software, Inc. notified customers of unauthorized access to the Aeries Student Information System. In late November 2019, the company detected unauthorized access attempts. Investigation revealed that parent and student login information, physical addresses, emails, and password hashes were accessed. The perpetrators were taken into custody and access was terminated. Aeries deployed security patches and engaged third-party auditors.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 1, 2019 → Notified Apr 27, 2020178d ✗ CA 60-day late29 weeks discovery → filing

Incident timeline

discovery → filing · 29 weeks / 202 days

Nov 1, 2019

Discovered

May 21, 2020

Filed

vs. sector median

+16 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Aeries
norm: aeries
Domain: aeries.com

Name: Aeries
norm: aeries
Domain: aeries.com
Industry: TechnologyllmEducationllm

Discovered: Nov 1, 2019
Materiality determined: —
Notification sent: Apr 27, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Working closely with local law enforcement and federal authorities

During the incident: Immediately began an investigation into whether these attempts had been successful
Deployed a series of security patches in the December 20, 2019 version of the Aeries SIS
Working closely with local law enforcement and federal authorities
Released a new feature in the March 26th version of Aeries to allow System Administrators to reset passwords for Parents and/or Students
Allocated several resources to perform a rigorous internal security audit
Engaging an independent third party to assist in conducting a complete audit and analysis of system security
Changes made: Deployed critical patches to ensure vulnerabilities were no longer a threat
Taken additional technical measures to prevent future incidents
Adopting new security protocols to increase protection of all customer data
Performing a rigorous internal security audit
Engaging an independent third party to conduct a complete audit and analysis of system security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(202 days from discovery to filing)
Compliance flags: CA 60-day late · 178d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 1, 2019
→ Notified: Apr 27, 2020
178d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 1, 2019 → Notified: Apr 27, 2020	178d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190283
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 21, 2020
Raw hash: be0ae1a86f0aa71d7a69f0f6eff8360070185071c3cf2830b5dd9613a81c62b1

Reporting entityAeries

Victim entityAeries

Incidentdiscovered Nov 1, 2019

Stated responseImmediately began an investigation into whether these attempts had been successful

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov