MalwareEducationEducationPhishingRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PIIMediumContained

Toledo Public Schools

bd_b59972043481565b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 8, 2020

Filed

Dec 14, 2020

To disclose

14 weeks

Affected

3state residents only

Linked

7 filings

Confidence

65%

Full breach record for Toledo Public Schools →

Toledo Public Schools notified employees of a September 8, 2020 cyberattack initiated via phishing that resulted in ransomware encryption and unauthorized disclosure of personal information including SSNs, driver's licenses, and bank details. TPS engaged forensic investigators and the FBI, secured systems, and offered credit monitoring. Affected individual count was not confirmed.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 97 days

Sep 8, 2020

Discovered

Dec 14, 2020

Filed

vs. sector median

+7 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemazebd_b6a6fa1b7f9ac0cc2020-09-08 · +97dVerified by operator

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_169eb168e655af892020-12-15 · +1dVerified
Maine State AGbd_63ebda663911d83c2020-12-15 · +1dCandidate
Indiana State AGbd_cf3884401154e7c92020-12-15 · +1dVerified by operator
Massachusetts State AGbd_3558660ce38deb1a2020-12-18 · +4dVerified

Show 1 more filing ↓up to 4d gap

New Hampshire State AGbd_c09cfce5d0d109352020-12-18 · +4dVerified

Name: Toledo Public Schools
norm: toledo public schools

Name: Toledo Public Schools
norm: toledo public schools
Industry: Educationllm

Discovered: Sep 8, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Contacted the Federal Bureau of Investigation
Initial access: phishing_link

During the incident: Engaged a forensic investigation firm
Contacted the Federal Bureau of Investigation
Secured all systems
Remediated risks
Brought systems back online
Provided updates to students, parents, and employees via email and on the TPS website
Provided notice to the credit bureaus
Providing complimentary identity theft and credit monitoring services
Changes made: Continuing to closely monitor its network and information systems for unusual activity
Strategically reduce network operations to minimize risk exposure to future incidents
Engaging additional resources and experts
Evaluating the extent of risk to personal information
Working to continue to improve its practices and systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(97 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Montana State AGDec 14 · first · this page

Maine State AG+1d

Indiana State AG+1d

Massachusetts State AG+4d

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/toledoSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 14, 2020
Raw hash: 64a4ce97750e2ec19f5f9b5e7f61d1f98ffbf67bf2fe8e2fe7cc4e42b52a2e21

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityToledo Public Schools

Victim entityToledo Public Schools

Incidentdiscovered Sep 8, 2020

Stated responseEngaged a forensic investigation firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov