AccidentalEducationEducationMisconfigurationCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)EducationMinorMediumResolved

Wiseburn Unified School District

bd_d85bca6efd8dc9bb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 4, 2017

Filed

May 30, 2017

To disclose

8 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Wiseburn Unified School District →

Wiseburn Unified School District notified the California Attorney General of a data breach involving student information stored with third-party vendor Schoolzilla. On April 4, 2017, a configuration error exposed backup files containing personally identifiable student information (names, IDs, grades, test scores) for students at several Wiseburn schools. A 'white hat' security researcher discovered the vulnerability, downloaded the files, and immediately notified Schoolzilla. The researcher affirmed under penalty of perjury that they deleted the data and did not share it. Schoolzilla fixed the error on April 5, 2017. No social security numbers or financial data were involved.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 4, 2017 → Notified May 25, 201750d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 8 weeks / 55 days

Apr 4, 2017

Begins

Apr 4, 2017

Discovered

May 30, 2017

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Wiseburn Unified School District
norm: wiseburn unified school district
Domain: wiseburn.org

Name: Wiseburn Unified School District
norm: wiseburn unified school district
Domain: wiseburn.org
Industry: Educationllm

Discovered: Apr 4, 2017
Breach occurred: Apr 4, 2017 – Apr 4, 2017
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: May 25, 2017
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)EducationMinor
Attack vector: Misconfiguration
Threat actor: External
Third party: via Schoolzilla PBC Inc. DBA Schoolzilla Inc.

During the incident: Immediately fixed the configuration error
Verified via log files that nobody other than the one security researcher accessed the exposed files
Ensured that the security researcher permanently and securely deleted the data
Reconfigured systems to fix the vulnerability
Changed passwords
Notified all customers with personal telephone calls and email correspondence and updates
Working with third-party security experts to augment existing data security practices
Running a 'Red Team Exercise' to test cybersecurity defenses
Ran additional diagnostics of local firewall protection system
Changes made: Reconfigured systems to fix the vulnerability
Changed passwords
Working with third-party security experts to augment existing data security practices
Running a 'Red Team Exercise' to test cybersecurity defenses
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: CA 60-day OK · 50d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 4, 2017
→ Notified: May 25, 2017
50d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 4, 2017 → Notified: May 25, 2017	50d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-69169
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 30, 2017
Raw hash: b9f3194a7eb9f4a3056e0a594fefd645ab4dcb78e7e6fadba2b8f996fb1a1b15

Reporting entityWiseburn Unified School District

Victim entityWiseburn Unified School District

Incidentdiscovered Apr 4, 2017

Stated responseImmediately fixed the configuration error

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov