MalwareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Shelley School District
bd_d530cffe515bbf52 · schema v1 · pii pii-v1
Full breach record for Shelley School District →Shelley School District (Idaho) disclosed a ransomware attack on December 6, 2021, affecting approximately 171 Idaho residents. Cybercriminals exfiltrated data including names, DOBs, addresses, SSNs/driver's licenses, and for a small subset, bank/payment card details. The District engaged forensic experts, notified the FBI and state regulators, and offered one year of Experian credit monitoring. Remediation includes MFA, enhanced backups, and endpoint detection.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_6d83b2b9c1f5dbf4Montana State AGfiled 2022-03-24(1d gap)Verified
- bd_3165929c1e2763c1Idaho State AGfiled 2022-02-23(28d gap)Candidate
Source provenance
- Source URL
- https://ag.idaho.gov/content/uploads/2022/03/03-23-22-Shelly-School-District.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 23, 2022
- Raw hash
- b2346439fd26cf04bf633db99c35d43237a5d1974fc1e870f0f0b4eeb5129ad1
Reporting entity
- Name
- Shelley School Districtnorm: shelley school district
Victim entity
- Name
- Shelley School Districtnorm: shelley school district
Incident
- Discovered
- Dec 6, 2021
- Materiality determined
- —
- Notification sent
- Mar 24, 2022
- Affected individuals
- 171
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Ransomware
- MITRE ATT&CK
- T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the Federal Bureau of Investigation (FBI)Provided regular updates to the Idaho Chief Information Security Officer, Chief Information Officer and Office of Risk ManagementNotified the Idaho State Department of Education and the Idaho Attorney General’s office
Compliance
- Time to disclose
- 15 weeks(107 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.