HackingEducationEducationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)CredentialsLowContained

Indianapolis Public Schools

bd_9818f8ee411a7f24 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 19, 2020

Filed

Dec 1, 2020

To disclose

32 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Indianapolis Public Schools →

Indianapolis Public Schools notified individuals of unauthorized access to employee email accounts discovered on April 19, 2020. The incident involved access to personal information (PII) within emails. IPS reset passwords, engaged forensic investigators, and offered 12 months of identity monitoring via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 32 weeks / 226 days

Apr 19, 2020

Discovered

Dec 1, 2020

Filed

vs. sector median

+24 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_3dcf1f2c5521955d2020-12-01Candidate
Indiana State AGbd_4b19b88c54c1fd312020-12-01Verified
Massachusetts State AGbd_e4b40f42dd7e06232020-12-01Verified

Name: Indianapolis Public Schools
norm: indianapolis public schools
Domain: myips.org

Name: Indianapolis Public Schools
norm: indianapolis public schools
Domain: myips.org
Industry: Educationllm

Discovered: Apr 19, 2020
Materiality determined: —
Notification sent: Sep 4, 2020
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Launched an investigation
Working with a third-party forensic investigation firm
Reset passwords for all relevant IPS email accounts
Reviewing our company policies and procedures relating to data security
Arranged to have Kroll provide identity monitoring services for 12 months at no cost
Changes made: Reviewing our company policies and procedures relating to data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(226 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGDec 1 · first

Indiana State AGDec 1 · first

Massachusetts State AGDec 1 · first

Montana State AGDec 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/ipsSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 1, 2020
Raw hash: bec938e21af0e4b321c55295f71c9f4f52a48093b62b8aefc26a3c99f12c2f8d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityIndianapolis Public Schools

Victim entityIndianapolis Public Schools

Incidentdiscovered Apr 19, 2020

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov