HackingEducationEducationVulnerability ExploitCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)CredentialsLowContained

Lemoore Union High School District

bd_97b6736d0e17cab5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 25, 2019

Filed

Aug 27, 2020

To disclose

39 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Lemoore Union High School District →

Lemoore Union High School District notified parents that an unauthorized individual exploited a vulnerability in the Aeries Student Information System in late November 2019. The exploit allowed access to parent and student names, home addresses, phone numbers, email addresses, and hashed passwords. The district required password changes and installed a software patch provided by Aeries. Law enforcement investigated and identified the suspect.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 21 days

discovery → filing · 39 weeks / 276 days

Nov 4, 2019

Begins

Nov 25, 2019

Discovered

Aug 27, 2020

Filed

vs. sector median

+31 wks slower

Part of Aeries supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Lemoore Union High School District
norm: lemoore union high school district
Domain: luhsd.k12.ca.us

Name: Lemoore Union High School District
norm: lemoore union high school district
Domain: luhsd.k12.ca.us
Industry: Educationllm

Discovered: Nov 25, 2019
Breach occurred: Nov 4, 2019
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Third party: via Aeries
Initial access: exploit_public_facing

During the incident: Law enforcement launched an investigation to identify the person responsible
Requiring all account holders whose accounts were involved to change their passwords
Changes made: Installed the software patch that Aeries made available to remedy the vulnerability
Reviewing existing policies and procedures to mitigate any risk associated with this incident and to better prevent future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 39 weeks(276 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-193515
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 27, 2020
Raw hash: 6d75df53711758fc4c15df8489e2e87260adbb96d430f4ce52a3103acd71bc9e

Reporting entityLemoore Union High School District

Victim entityLemoore Union High School District

Incidentdiscovered Nov 25, 2019

Stated responseLaw enforcement launched an investigation to identify the person responsible

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov