HackingEducationEducationVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)CredentialsLowResolved

San Leandro Unified School District

bd_d60c7957ff898cf7 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 30, 2019

Filed

Jun 11, 2020

To disclose

28 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for San Leandro Unified School District →

San Leandro Unified School District notified parents that an unauthorized individual exploited a vulnerability in the Aeries Student Information System software. The incident occurred on November 4, 2019, and was discovered in late November 2019. Affected data included parent/student names, addresses, phone numbers, emails, and hashed passwords. The district required password changes and installed a software patch. Law enforcement investigated and identified the suspect.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 30, 2019 → Notified May 6, 2020158d ✗ CA 60-day late28 weeks discovery → filing

Incident timeline

undetected · 26 days

discovery → filing · 28 weeks / 194 days

Nov 4, 2019

Begins

Nov 30, 2019

Discovered

Jun 11, 2020

Filed

Part of Aeries supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: San Leandro Unified School District
norm: san leandro unified school district

Name: San Leandro Unified School District
norm: san leandro unified school district
Industry: Educationllm

Discovered: Nov 30, 2019
Breach occurred: Nov 4, 2019
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 6, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unknown
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Law enforcement launched an investigation to identify the person responsible
Third party: via Aeries
Initial access: exploit_public_facing

During the incident: Required all account holders whose accounts were involved to change their passwords
Installed the software patch that Aeries made available to remedy the vulnerability
Reviewing existing policies and procedures to mitigate any risk associated with this incident
Changes made: Installed the software patch that Aeries made available to remedy the vulnerability
Reviewing existing policies and procedures to mitigate any risk associated with this incident and to better prevent future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(194 days from discovery to filing)
Compliance flags: CA 60-day late · 158d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 30, 2019
→ Notified: May 6, 2020
158d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 30, 2019 → Notified: May 6, 2020	158d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190823
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2020
Raw hash: 6a89590fb56e9d479f67a7839a31156a7368ced97916288079e6a3a6c24888a7

Reporting entitySan Leandro Unified School District

Victim entitySan Leandro Unified School District

Incidentdiscovered Nov 30, 2019

Stated responseRequired all account holders whose accounts were involved to change their passwords

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov