HackingEducationEducationVulnerability ExploitData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

Fairfax County Public Schools

bd_b9cdc86785fdedce · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 6, 2020

Filed

Nov 16, 2020

To disclose

10 weeks

Affected · nationwide

19,65334 in this filing

Linked

8 filings

Confidence

66%

Full breach record for Fairfax County Public Schools →

Fairfax County Public Schools (Virginia) reported an external system breach (hacking) occurring between August 21, 2020, and September 5, 2020, discovered on September 6, 2020. The incident compromised the personal information of 19,653 individuals, including Social Security Numbers. The organization notified affected individuals in writing on November 9, 2020, and provided 12 months of credit monitoring and identity restoration services through Experian. 34 Maine residents were specifically affected.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 6, 2020 → Filed with AG Nov 16, 202071d ⏱ ME AG >30d10 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 16 days

discovery → filing · 10 weeks / 71 days

Aug 21, 2020

Begins

Sep 6, 2020

Discovered

Nov 16, 2020

Filed

vs. sector median

+2 wks slower

This filing is one of 8 about the same incident.View merged incident

A leak claim by maze about this victim predates this filing by 66 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemazebd_e693ce2405ac54162020-09-11 · +66dVerified by operator

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_b2163e3e9e7ff0db2020-11-16Verified
New Hampshire State AGMaze groupbd_6ac696a4588c5bbe2020-11-19 · +3dVerified by operator
Montana State AGMaze groupbd_4be94d2b976bd78e2020-11-09 · +7dVerified
Indiana State AGbd_6a73de764768cc672020-11-09 · +7dVerified by operator

Show 2 more filings ↓up to 104d gap

Indiana State AGbd_9c838cbce0cb732a2021-01-21 · +66dVerified by operator
Maine State AGbd_2f6404a7d799f9d32021-02-28 · +104dVerified

Name: Fairfax County Public Schools
norm: fairfax county public schools
Domain: fcps.edu

Name: Fairfax County Public Schools
norm: fairfax county public schools
Domain: fcps.edu
Industry: Educationllm

Discovered: Sep 6, 2020
Breach occurred: Aug 21, 2020 – Sep 5, 2020
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 9, 2020
Affected individuals: 19,653state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notice with the Maine Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12 months of identity/credit monitoring and identity restoration services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(71 days from discovery to filing)
Compliance flags: ME AG >30d · 71dME resident >60d · 64dLeak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 6, 2020
→ Filed with AG: Nov 16, 2020
71d 30 days (soft) ME AG >30d
Maine
Discovered: Sep 6, 2020
→ Notified: Nov 9, 2020
64d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 6, 2020 → Filed with AG: Nov 16, 2020	71d	30 days (soft)	ME AG >30d
Maine	Discovered: Sep 6, 2020 → Notified: Nov 9, 2020	64d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Montana State AGNov 9 · first

Indiana State AGNov 9 · first

Massachusetts State AG+7d

Maine State AG+7d · this page

New Hampshire State AG+10d

Indiana State AG+73d

Maine State AG+111d

Pattern: first filing Nov 9 (MT), last Feb 28 (ME) — a 111-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/076be210-042f-4a95-9a94-d121e1aa1600.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 16, 2020
Raw hash: c78d9d70ae1fad20ab23d4596dfed48458b3a8ea7c277eee8462b3352157380c

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityFairfax County Public Schools

Victim entityFairfax County Public Schools

Incidentdiscovered Sep 6, 2020

Stated responseSent written notification to affected individuals

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov