HackingEducationEducationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumActive

Rochester Public Schools

bd_dbf00d21bb721d93 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 6, 2023

Filed

May 5, 2023

To disclose

29 days

Affected

4state residents only

Linked

4 filings

Confidence

66%

Full breach record for Rochester Public Schools →

Rochester Public Schools notified affected individuals on May 4, 2023, of a data security incident detected on April 6, 2023. An unauthorized individual accessed systems, obtaining personal information including names, SSNs, driver's licenses, and financial account numbers of current and former employees. The investigation is ongoing. The school engaged third-party forensic experts and is offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 29 days

Apr 6, 2023

Discovered

May 5, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_ac99ca1955fe31c42023-05-04 · +1dVerified
New Hampshire State AGbd_11941aec56962c9f2023-05-11 · +6dVerified
Massachusetts State AGbd_5f2b7ee6cb1445602023-05-11 · +6dVerified

Name: Rochester Public Schools
norm: rochester public schools

Name: Rochester Public Schools
norm: rochester public schools
Industry: Educationllm

Discovered: Apr 6, 2023
Materiality determined: —
Notification sent: May 4, 2023
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Launched an investigation into the incident with the assistance of independent third-party cybersecurity experts
Engaged third-party forensic experts to assist in the investigation
Took immediate steps to further secure our systems
Providing you with access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing you with proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMay 4 · first

Montana State AG+1d · this page

New Hampshire State AG+7d

Massachusetts State AG+7d

Pattern: first filing May 4 (IN), last May 11 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-250.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 5, 2023
Raw hash: ee84d2e43ae47362a26adc797fbac7662ef5c58b4db2f54cc680640aca67acbf

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRochester Public Schools

Victim entityRochester Public Schools

Incidentdiscovered Apr 6, 2023

Stated responseLaunched an investigation into the incident with the assistance of independent third-party cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov