HackingEducationEducationStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowActive

Mountain Home School District #193

bd_b39d7fbd29d4005b · schema v1 · pii pii-v1

Severity

Low

Discovered

May 2, 2026

Filed

May 7, 2026

To disclose

5 days

Affected

Not disclosed

Confidence

67%

Full breach record for Mountain Home School District #193 →2 incidents on file

Mountain Home School District 193 notified Idaho AG of a cybersecurity incident involving third-party provider Instructure (Canvas). On May 2, 2026, Instructure reported unauthorized access to user data including usernames, emails, student IDs, and private messages. No passwords, SSNs, or financial data were compromised. Investigation is ongoing with law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 days

May 2, 2026

Discovered

May 7, 2026

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Mountain Home School District #193
norm: mountain home school district 193
Domain: mtnhomesd.org

Name: Mountain Home School District #193
norm: mountain home school district 193
Domain: mtnhomesd.org
Industry: Educationllm

Discovered: May 2, 2026
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Idaho Attorney General's OfficeNotifying the Executive Director of the Idaho State Board of Education and the State Superintendent of Public Instruction
Third party: via Instructure (Canvas)
Initial access: valid_credentials

During the incident: Notified the FBI, U.S. Cybersecurity and Infrastructure Security Agency (CISA), and international law enforcement partners
Rotated security keys
Revoked compromised credentials
Remediated the underlying vulnerability
Notifying parents, guardians, and staff regarding the incident
Auditing administrative role assignments
Changes made: Enforces Multi-Factor Authentication (MFA) on privileged accounts
Auditing administrative role assignments
Following all protocols provided by the vendor
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 days(5 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2026/05/2026.05.06-Mtn.-Home-School-Dist.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 7, 2026
Raw hash: 9cb338c64be7df4f055047c3b508446d3fd82186d7d7f8514e7dad442a435edf

Reporting entityMountain Home School District #193

Victim entityMountain Home School District #193

Incidentdiscovered May 2, 2026

Stated responseNotified the FBI, U.S. Cybersecurity and Infrastructure Security Agency (CISA), and international law enforcement partners

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov