AccidentalMisconfigurationSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICEDUCATIONLowContained
Rocklin Unified School District
bd_922a8a6be635a218 · schema v1 · pii pii-v1
Full breach record for Rocklin Unified School District →Rocklin Unified School District notified families of a data security breach involving its student lunch data program, NutriKids-NutriLink. On September 17, 2020, the district was informed of a software bug allowing unauthorized access to student information. The vendor fixed the bug on September 18, 2020. Affected data included student names, IDs, and free/reduced lunch status. No SSNs or financial data were stored in the system. The district removed the portal link from its website and notified the California AG.
California clockDiscovered Sep 17, 2020 → Notified Sep 18, 20201d ✓ CA 60-day OK≤1 day discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-194221
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 18, 2020
- Raw hash
- 23e9a1b4cc53e8db8265531e6afe976929c21e76ef50c651b2edbb01438b4dc6
Reporting entity
- Name
- Rocklin Unified School Districtnorm: rocklin unified school district
- Domain
- rocklinusd.org
Victim entity
- Name
- Rocklin Unified School Districtnorm: rocklin unified school district
- Domain
- rocklinusd.org
Incident
- Discovered
- Sep 17, 2020
- Materiality determined
- —
- Notification sent
- Sep 18, 2020
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICEDUCATION
- Attack vector
- Misconfiguration
- Regulator citations
- Submitted Data Security Breach notifications with the California Office of the Attorney General
- Third party
- via NutriKids-NutriLink
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- ≤1 day(1 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 1d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Sep 17, 2020→ Notified: Sep 18, 20201d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.