Social EngineeringEducationEducationPhishingStolen CredentialsCapture App DataEmployee Data InvolvedMulti-Stage ChainData ExfiltratedPIIGovernment IDIdentity (basic)Health (basic)PHIMediumContained

Carmel Unified School District

bd_8e5c53cd9277ef24 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Mar 8, 2019

To disclose

—

Affected

Not disclosed

Confidence

82%

Full breach record for Carmel Unified School District →

Carmel Unified School District experienced a phishing incident around January 5, 2019, in which an outside individual sent phishing emails to employees, resulting in unauthorized access to employee email accounts. Affected data included employee and dependent SSNs, marriage certificates, birth certificates, and medical notes. The District reset passwords, removed phishing messages, enhanced mail filtering, and offered one year of Experian IdentityWorks identity protection to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 5, 2019

Begins

Mar 8, 2019

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Carmel Unified School District
norm: carmel unified school district
Domain: carmelunified.org

Name: Carmel Unified School District
norm: carmel unified school district
Domain: carmelunified.org
Industry: Educationllm

Discovered: —
Breach occurred: Jan 5, 2019
Materiality determined: —
Notification sent: Jan 9, 2019
Affected individuals: Not disclosed
Data types: PIIGovernment IDIdentity (basic)Health (basic)PHI
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified California Attorney General
Initial access: phishing_link

During the incident: Identified the 'phishing' message characteristics and removed all known copies of the message from users' mailboxes
Adjusted mail system settings to enhance detection for this message or similar 'phishing' messages, as well as providing a visual warning to users for suspicious messages
Sent initial and follow up notices to employees about this incident by phone, text, and email
Reset all employee passwords
On January 9, 2019, the District sent employees an initial notice of this incident, prompting them to enable two-step authentication for their Gmail accounts, change passwords for any accounts linked to their District account or that share the same credentials as their District account, and notify the District if they have provided their username or password in response to the 'phishing' email
Offering one year of complimentary identity protection services from Experian's IdentityWorks
Changes made: Working closely with the Monterey County Office of Education to improve data security and ensure the confidentiality of personal information
Auditing its practices of document transfer, email storage, and encryption
Reviewing current computer security training practices and developing more cybersecurity training for employees
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-145289
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 8, 2019
Raw hash: 4dad83fb9405e93e6fcf51945ab8dead40e4b10a8781347625e1fc973c1d85ee

Reporting entityCarmel Unified School District

Victim entityCarmel Unified School District

IncidentPhishing

Stated responseIdentified the 'phishing' message characteristics and removed all known copies of the message from users' mailboxes

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov