AccidentalEducationEducationMisconfigurationSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)EducationLowContained

Rocklin Unified School District

bd_922a8a6be635a218 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 17, 2020

Filed

Sep 18, 2020

To disclose

≤1 day

Affected

Not disclosed

Confidence

66%

Full breach record for Rocklin Unified School District →3 incidents on file

Rocklin Unified School District notified families of a data security breach involving its student lunch data program, NutriKids-NutriLink. On September 17, 2020, the district was informed of a software bug allowing unauthorized access to student information. The vendor fixed the bug on September 18, 2020. Affected data included student names, IDs, and free/reduced lunch status. No SSNs or financial data were stored in the system. The district removed the portal link from its website and notified the California AG.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 17, 2020 → Notified Sep 18, 20201d ✓ CA 60-day OK≤1 day discovery → filing

Incident timeline

discovery → filing · ≤1 day / 1 days

Sep 17, 2020

Discovered

Sep 18, 2020

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Rocklin Unified School District
norm: rocklin unified school district
Domain: rocklinusd.org

Name: Rocklin Unified School District
norm: rocklin unified school district
Domain: rocklinusd.org
Industry: Educationllm

Discovered: Sep 17, 2020
Materiality determined: —
Notification sent: Sep 18, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Education
Attack vector: Misconfiguration
Regulator citations: Submitted Data Security Breach notifications with the California Office of the Attorney General
Third party: via NutriKids-NutriLink
Initial access: exploit_public_facing

During the incident: Removed the link to the NutriKids portal from our district website
Submitted Data Security Breach notifications with the California Office of the Attorney General
Continued to monitor this issue
Changes made: Fixed the bug and removed the ability to gain access through the portal
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: CA 60-day OK · 1d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 17, 2020
→ Notified: Sep 18, 2020
1d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 17, 2020 → Notified: Sep 18, 2020	1d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-194221
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 18, 2020
Raw hash: 23e9a1b4cc53e8db8265531e6afe976929c21e76ef50c651b2edbb01438b4dc6

Reporting entityRocklin Unified School District

Victim entityRocklin Unified School District

Incidentdiscovered Sep 17, 2020

Stated responseRemoved the link to the NutriKids portal from our district website

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov