HackingEducationEducationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

San Luis Coastal Unified School District

bd_b591d42a56115912 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 19, 2022

Filed

Sep 16, 2022

To disclose

8 weeks

Affected

1state residents only

Linked

6 filings

Confidence

66%

Full breach record for San Luis Coastal Unified School District →

San Luis Coastal Unified School District notified employees and dependents of a cyberattack occurring around May 22, 2022, discovered July 19, 2022. Personal information including names, SSNs, and DOBs was potentially accessed. No financial data involved. FBI notified; forensic experts engaged; identity monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 58 days

discovery → filing · 8 weeks / 59 days

May 22, 2022

Begins

Jul 19, 2022

Discovered

Sep 16, 2022

Filed

vs. sector median

+1 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitevicesocietybd_d32f96d2e832d9f32022-12-20 · +95dVerified by operator
Leak Sitevicesocietybd_01d01ec3ed5957432022-07-19 · +59dVerified by operator

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_58afaa36fb0676542022-09-16Verified
California State AGbd_747eec21b73865462022-09-16Candidate
Indiana State AGbd_790322a25f3360ce2022-09-16Verified by operator

Name: San Luis Coastal Unified School District
norm: san luis coastal unified school district

Name: San Luis Coastal Unified School District
norm: san luis coastal unified school district
Industry: Educationllm

Discovered: Jul 19, 2022
Breach occurred: May 22, 2022
Undetected for: 58 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 16, 2022
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: reported the Incident to the Federal Bureau of Investigation (“FBI”)
Initial access: valid_credentials

During the incident: Launched an in-depth investigation to determine the scope of the Incident and identify those potentially affected
Working with our information technology team
Engaging third-party forensic experts
Taking steps to confirm the integrity of SLCUSD’s systems
Worked with third-party experts to determine what information may have been at risk
Reported the Incident to the Federal Bureau of Investigation (“FBI”)
Offering complimentary access to identity monitoring, fraud consultation, and identity theft restoration services
Changes made: Taking steps to minimize the chances of a similar occurrence happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGSep 16 · first

California State AGSep 16 · first

Indiana State AGSep 16 · first

Montana State AGSep 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-569.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2022
Raw hash: 5b26a059db05966915ac1b66302d9801492af588683cc47b35fc79884069465e

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entitySan Luis Coastal Unified School District

Victim entitySan Luis Coastal Unified School District

Incidentdiscovered Jul 19, 2022

Stated responseLaunched an in-depth investigation to determine the scope of the Incident and identify those potentially affected

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov