MalwareEducationEducationRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedAuthenticationEducationFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

Highline School District

bd_a86c1aaf38019573 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 7, 2024

Filed

Apr 2, 2025

To disclose

30 weeks

Affected

92,954state residents only

Confidence

69%

Full breach record for Highline School District →

Highline School District (WA) disclosed a ransomware incident discovered on September 7, 2024. An unknown actor accessed systems and exfiltrated files containing PII, PHI, SSNs, and financial data. 92,954 Washington residents were affected. Notices were sent on April 2, 2025. The District engaged forensic specialists, notified law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d30 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

discovery → filing · 30 weeks / 207 days

Sep 7, 2024

Discovered

Apr 2, 2025

Filed

vs. sector median

+21 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed92,954 affectedView incident

Name: Highline School District
norm: highline school district
Domain: highlineschools.org

Name: Highline School District
norm: highline school district
Domain: highlineschools.org
Industry: Educationllm

Discovered: Sep 7, 2024
Materiality determined: —
Notification sent: Apr 2, 2025
Affected individuals: 92,954state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthStudent ID numberPassport numberHealth insurance IDMedical informationUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement

During the incident: Took steps to secure its systems
Initiated investigation with third-party computer forensic specialists
Undertook review of involved files to determine if personal information was involved
Notified federal law enforcement
Provided access to credit monitoring services for twelve (12) months through IDX
Provided guidance on how to better protect against identity theft and fraud
Changes made: Implement additional safeguards and training to its employees
Build upon pre-existing cybersecurity practices
Additional security measures are being implemented to further protect against similar incidents moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(207 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32909.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2025
Raw hash: 88abdf5f0df4158260e9ad624c9baa52d6bb8bcde415f2720449e5c66e3050bf

Reporting entityHighline School District

Victim entityHighline School District

Incidentdiscovered Sep 7, 2024

Stated responseTook steps to secure its systems

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com