HackingDelayed DiscoveryIDENTITY_BASICLowContained
Portland Public Schools
bd_c089e457a397121d · schema v1 · pii pii-v1
Full breach record for Portland Public Schools →Portland Public Schools experienced unauthorized network access on or about February 2, 2025. Forensic investigators determined on January 6, 2026, that some personal information, including full names, may have been accessed. The school is offering complimentary Experian IdentityWorks membership to affected individuals. No reports of identity theft or financial fraud were known at the time of notice.
Vermont clock✗ VT AG >45 bday52 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 4 about the same incident.View merged incident
A leak claim by ransomhub about this victim predates this filing by 390 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_24c550503f100c93Maine State AGfiled 2026-01-30Candidate
- bd_7d0298ae14e91fecIndiana State AGfiled 2026-01-30Verified by operator
- bd_c67522245a0e6714New Hampshire State AGfiled 2026-02-05(6d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-01-30-portland-public-schools-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 30, 2026
- Raw hash
- 374a6cf5bad5f9c68b07539503ceba6bd6c83263147f23fcdc68c12293a0699c
Reporting entity
- Name
- Portland Public Schoolsnorm: portland public schools
- Domain
- portlandschools.org
- Industry
- education
Victim entity
- Name
- Portland Public Schoolsnorm: portland public schools
- Domain
- portlandschools.org
- Industry
- education
Incident
- Discovered
- Feb 2, 2025
- Materiality determined
- —
- Notification sent
- Jan 30, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Filed notice with the Office of the Vermont Attorney General
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 52 weeks(362 days from discovery to filing)
- Compliance flags
- VT AG >45 bdayLeak >180d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.