HackingEducationEducationStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Tucson Unified School District

bd_ad003862c2de9962 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 20, 2023

Filed

Aug 29, 2023

To disclose

32 weeks

Affected

6state residents only

Linked

7 filings

Confidence

67%

Full breach record for Tucson Unified School District →

Tucson Unified School District notified NH AG of unauthorized network access discovered Jan 20, 2023. Incident impacted ~6 NH residents. Data included personal info (PII/ID). TUSD contained threat, notified law enforcement, engaged forensic experts. Notification sent Aug 25, 2023. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d32 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 32 weeks / 221 days

Jan 20, 2023

Discovered

Aug 29, 2023

Filed

vs. sector median

+25 wks slower

This filing is one of 7 about the same incident.View merged incident

A leak claim by blacksuit about this victim predates this filing by 199 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblacksuitbd_69f37fdd1fab17532023-02-10 · +199dVerified by operator

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_00f8f98f599766d12023-08-25 · +4dVerified
Massachusetts State AGbd_2967632dd3a0e5d42023-08-25 · +4dVerified by operator
Maine State AGbd_45ef2b70ad4e38d42023-08-25 · +4dVerified
Indiana State AGbd_b7467a092f1539092023-08-25 · +4dVerified

Show 1 more filing ↓up to 4d gap

Vermont State AGbd_c7c4fe71fa42161e2023-08-25 · +4dVerified

Name: Tucson Unified School District
norm: tucson unified school district

Name: Tucson Unified School District
norm: tucson unified school district
Industry: Educationllm

Discovered: Jan 20, 2023
Materiality determined: —
Notification sent: Aug 25, 2023
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Contained the threat by disabling all unauthorized access to its network
Notified law enforcement
Commenced a prompt and thorough investigation
Worked very closely with external cybersecurity professionals
Conducted a thorough manual review of the data
Changes made: Offering the affected residents complimentary memberships with a credit monitoring service
Advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Providing contact information for the consumer reporting agencies and the Federal Trade Commission
Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(221 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGAug 25 · first

Massachusetts State AGAug 25 · first

Maine State AGAug 25 · first

Indiana State AGAug 25 · first

Vermont State AGAug 25 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/tucson-unified-school-district-20230829.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 29, 2023
Raw hash: 6f78a00af698934552a6469df3024113d725e97277ea1a57d654eda44aa1cfc1

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityTucson Unified School District

Victim entityTucson Unified School District

Incidentdiscovered Jan 20, 2023

Stated responseContained the threat by disabling all unauthorized access to its network

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov