AccidentalEducationEducationMisdeliveryCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)EducationMinorMediumResolved

Riverdale Joint Unified School District

bd_b4c5b18a431aa8ab · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 20, 2025

Filed

Mar 27, 2025

To disclose

7 days

Affected

Not disclosed

Confidence

65%

Full breach record for Riverdale Joint Unified School District →

Riverdale Joint Unified School District notified parents and staff that a third-party vendor, Tulare County Office of Education (TCOE), inadvertently distributed student and staff PII via email to unauthorized recipients. The data included names, emails, phone numbers, dates of birth, and grades. No SSNs or financial data were exposed. The incident was discovered on March 20, 2025, following an occurrence on March 18, 2025.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 20, 2025 → Notified Mar 26, 20256d ✓ CA 60-day OK7 days discovery → filing

Incident timeline

undetected · 2 days

discovery → filing · 7 days

Mar 18, 2025

Begins

Mar 20, 2025

Discovered

Mar 27, 2025

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Riverdale Joint Unified School District
norm: riverdale joint unified school district
Domain: rjusd.org

Name: Riverdale Joint Unified School District
norm: riverdale joint unified school district
Domain: rjusd.org
Industry: Educationllm

Discovered: Mar 20, 2025
Breach occurred: Mar 18, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 26, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)EducationMinor
Attack vector: Unknown
Threat actor: Internal
Third party: via Tulare County Office of Education

During the incident: Confirmed that no Social Security Numbers or financial information was disclosed
Advised that the email and its content have been deleted
Changes made: Taking all precautions to prevent future security breaches from occurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: CA 60-day OK · 6d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 20, 2025
→ Notified: Mar 26, 2025
6d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 20, 2025 → Notified: Mar 26, 2025	6d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-600467
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 27, 2025
Raw hash: ef81705f097f5bb7265aa466c66c27840927fe965ef135ba3d6d0ef8686a302f

Reporting entityRiverdale Joint Unified School District

Victim entityRiverdale Joint Unified School District

Incidentdiscovered Mar 20, 2025

Stated responseConfirmed that no Social Security Numbers or financial information was disclosed

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov