HackingEducationEducationSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)EducationLowContained

Las Lomitas Elementary School District

bd_a02811f28e92dd10 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 5, 2026

Filed

May 11, 2026

To disclose

6 days

Affected

Not disclosed

Confidence

67%

Full breach record for Las Lomitas Elementary School District →

Las Lomitas Elementary School District (LLESD) notified the California AG of a data breach involving its Canvas LMS platform. Instructure, the publisher of Canvas, notified LLESD on May 5, 2026, that a criminal threat actor had gained access to LLESD information. The breach affected students in 6th-8th grade during the 2023-2024 school year, their caregivers, and staff. Affected data included first/last names, email addresses, and class enrollments. Instructure stated no passwords, dates of birth, government identifiers, or financial information were involved. LLESD IT confirmed the scope of data. Affected individuals are being contacted directly.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 days

May 5, 2026

Discovered

May 11, 2026

Filed

vs. sector median

8 wks faster

Part of Instructure, Inc. supply-chain incident (2026) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Las Lomitas Elementary School District
norm: las lomitas elementary school district
Domain: llesd.org

Name: Las Lomitas Elementary School District
norm: las lomitas elementary school district
Domain: llesd.org
Industry: Educationllm

Discovered: May 5, 2026
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Education
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Instructure
Initial access: supply_chain

During the incident: LLESD IT reviewed the personal information in Canvas to confirm what data was contained
Staff and caregivers who were affected will be contacted directly
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-623195
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 11, 2026
Raw hash: 5e291aef01570a1f05ca83517774ab508ffccd9a71b635b5dd6ee91d39705025

Reporting entityLas Lomitas Elementary School District

Victim entityLas Lomitas Elementary School District

Incidentdiscovered May 5, 2026

Stated responseLLESD IT reviewed the personal information in Canvas to confirm what data was contained

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov