HackingEducationEducationEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

San Luis Coastal Unified School District

bd_747eec21b7386546 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 19, 2022

Filed

Sep 16, 2022

To disclose

8 weeks

Affected

Not disclosed

Linked

6 records

Confidence

64%

Full breach record for San Luis Coastal Unified School District →

San Luis Coastal Unified School District notified employees that their personal information, including names, Social Security numbers, and dates of birth, may have been accessed due to a cyberattack occurring around May 22, 2022. The district discovered the incident on July 19, 2022. No financial account information was involved. The district engaged forensic experts, notified the FBI, and offered identity protection services to affected employees.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d8 weeks discovery → filing

Incident timeline

undetected · 58 days

discovery → filing · 8 weeks / 59 days

May 22, 2022

Begins

Jul 19, 2022

Discovered

Sep 16, 2022

Filed

This filing is one of 6 records about the same incident.View merged incident

A leak claim by vicesociety about this victim was first seen 59 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitevicesocietybd_d32f96d2e832d9f32022-12-20 · +95dVerified by operator
Leak Sitevicesocietybd_01d01ec3ed5957432022-07-19 · +59dVerified by operator

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_58afaa36fb0676542022-09-16Verified
Indiana State AGbd_790322a25f3360ce2022-09-16Verified by operator
Montana State AGbd_b591d42a561159122022-09-16Verified by operator

Name: San Luis Coastal Unified School District
norm: san luis coastal unified school district

Name: San Luis Coastal Unified School District
norm: san luis coastal unified school district
Industry: Educationllm

Discovered: Jul 19, 2022
Breach occurred: May 22, 2022
Undetected for: 58 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 16, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unknown
Threat actor: External
Regulator citations: Reported the Incident to the Federal Bureau of Investigation (“FBI”)

During the incident: Launched an in-depth investigation to determine the scope of the Incident and identify those potentially affected
Working with our information technology team
Engaging third-party forensic experts
Taking steps to confirm the integrity of SLCUSD’s systems
Reported the Incident to the Federal Bureau of Investigation (“FBI”)
Offering complimentary access to identity monitoring, fraud consultation, and identity theft restoration services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: Leak >30dCA 60-day OK · 59d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 19, 2022
→ Notified: Sep 16, 2022
59d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 19, 2022 → Notified: Sep 16, 2022	59d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGSep 16 · first

Indiana State AGSep 16 · first

Montana State AGSep 16 · first

California State AGSep 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-557337
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2022
Raw hash: cc127c998d158be8dbc144dcacb07e236a80f5d17de057d432a53d994b5648e3

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entitySan Luis Coastal Unified School District

Victim entitySan Luis Coastal Unified School District

Incidentdiscovered Jul 19, 2022

Stated responseLaunched an in-depth investigation to determine the scope of the Incident and identify those potentially affected

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov