HackingEducationEducationPhishingStolen CredentialsCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Government IDHealth (basic)MediumContained

Interstate 35 Community School District

bd_ce310c799123d047 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 7, 2025

Filed

Jan 20, 2026

To disclose

46 weeks

Affected

910state residents only

Confidence

66%

Interstate 35 Community School District notified Iowa AG of a March 7, 2025 incident where an unauthorized party accessed an employee email account, potentially exposing names, SSNs, driver's licenses, and medical info for 910 residents. Notification sent Jan 20, 2026. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Iowa clock✓ IA AG ≤5 bday46 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 46 weeks / 319 days

Mar 7, 2025

Begins

Mar 7, 2025

Discovered

Jan 20, 2026

Filed

vs. sector median

+37 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed910 affectedView incident

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Interstate 35 Community School District
norm: interstate 35 community school district
Industry: Educationllm

Discovered: Mar 7, 2025
Breach occurred: Mar 7, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 20, 2026
Affected individuals: 910state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Iowa Attorney General's Office Consumer Protection Division
Initial access: phishing_link

During the incident: Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Conducted an extensive forensic investigation and internal review
Providing the affected residents with written notification
Offering complimentary memberships with a credit monitoring service
Advising the affected residents about the process for placing fraud alerts and/or security freezes
Providing contact information for consumer reporting agencies and the Federal Trade Commission
Setting up a dedicated and confidential toll-free response line
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 46 weeks(319 days from discovery to filing)
Compliance flags: IA AG ≤5 bday
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.iowaattorneygeneral.gov/media/cms/1202026_Interstate_35_Community_Sch_8EDBCABD54DEF.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 20, 2026
Raw hash: 4ec3d44197e9305730aa4699ac7ca9cf680b872657f42c65bf877129f694544e

Reporting entityMCDONALD HOPKINS LLC

Victim entityInterstate 35 Community School District

Incidentdiscovered Mar 7, 2025

Stated responseCommenced a prompt and thorough investigation

ComplianceIA AG ≤5 bday

Extraction provenanceno artifact recorded

Source provenancewww.iowaattorneygeneral.gov