HackingEducationEducationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)PHIHealth (basic)MinorMediumContained

Visalia Unified School District

bd_7e11cf9fb80167e9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 6, 2021

Filed

Dec 30, 2021

To disclose

30 weeks

Affected

Not disclosed

Linked

2 records

Confidence

65%

Full breach record for Visalia Unified School District →

Visalia Unified School District (VUSD) reported unauthorized access to certain email accounts between January 1, 2021, and June 3, 2021. The incident was identified on June 6, 2021. Affected data included names and medical information for students and staff. VUSD implemented additional security measures, reviewed policies, provided employee training, and offered complimentary identity monitoring services through IDX. No misuse of information was confirmed.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 6, 2021 → Notified Dec 30, 2021207d ✗ CA 60-day late30 weeks discovery → filing

Incident timeline

undetected · 156 days

discovery → filing · 30 weeks / 207 days

Jan 1, 2021

Begins

Jun 6, 2021

Discovered

Dec 30, 2021

Filed

This filing is one of 2 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteryukbd_31700e5fe96a669d2021-05-18 · +226dCandidate

Name: Visalia Unified School District
norm: visalia unified school district
Domain: vusd.org

Name: Visalia Unified School District
norm: visalia unified school district
Domain: vusd.org
Industry: Educationllm

Discovered: Jun 6, 2021
Breach occurred: Jan 1, 2021 – Jun 3, 2021
Undetected for: 156 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 30, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)PHIHealth (basic)Minor
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External

During the incident: Implemented additional technical security measures
Reviewing and enhancing existing policies and procedures
Providing additional training to employees regarding data security
Offering access to complimentary monitoring services through IDX
Changes made: Implemented additional technical security measures
Reviewing and enhancing existing policies and procedures to reduce the likelihood of a similar future event
Providing additional training to employees regarding data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(207 days from discovery to filing)
Compliance flags: CA 60-day late · 207d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 6, 2021
→ Notified: Dec 30, 2021
207d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 6, 2021 → Notified: Dec 30, 2021	207d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-549009
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 30, 2021
Raw hash: 32f57c01c40d555de4ced11f659d0044b6f3ae2aa613e1f26615821b6aa941bc

Linked disclosures

Ransomware claims (1)

Reporting entityVisalia Unified School District

Victim entityVisalia Unified School District

Incidentdiscovered Jun 6, 2021

Stated responseImplemented additional technical security measures

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov