MalwareEducationEducationRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedAuthenticationFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

Grandview School District

bd_dd78f94018b4de56 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 7, 2024

Filed

Jun 15, 2026

To disclose

21 months

Affected

9,414state residents only

Linked

2 filings

Confidence

71%

Full breach record for Grandview School District →

Grandview School District (WA) reported a ransomware cyberattack occurring between Sept 28 and Oct 8, 2024. Discovered Oct 7, 2024, the incident exposed PII including SSNs, DOBs, driver's licenses, financial account info, and health data for 9,414 Washington residents. Notices sent June 15, 2026. Remediation includes credit monitoring via Cyberscout and enhanced employee training.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d21 months discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 9 days

discovery → filing · 21 months / 616 days

Sep 28, 2024

Begins

Oct 7, 2024

Discovered

Jun 15, 2026

Filed

vs. sector median

+79 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblacksuitbd_297ad00e3f5977332024-10-08 · +615dCandidate

Name: Grandview School District
norm: grandview school district
Domain: gsd200.org

Name: Grandview School District
norm: grandview school district
Domain: gsd200.org
Industry: Educationllm

Discovered: Oct 7, 2024
Breach occurred: Sep 28, 2024 – Oct 8, 2024
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 15, 2026
Affected individuals: 9,414state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberMedical informationUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Providing written notice of this incident to relevant state regulators, as necessary

During the incident: Moved quickly to investigate and respond to the incident
Assessed the security of GSD systems
Identified potentially affected individuals
Providing access to credit monitoring services for twelve (12) months, through Cyberscout, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Implementing additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 months(616 days from discovery to filing)
Compliance flags: Leak >180dWA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41325.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 15, 2026
Raw hash: 96177667b47a9a478c622aad2cfda5deafc8034c79a0949245742ac8cb36a34e

Linked disclosures

Ransomware claims (1)

Reporting entityGrandview School District

Victim entityGrandview School District

Incidentdiscovered Oct 7, 2024

Stated responseMoved quickly to investigate and respond to the incident

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com