AccidentalEducationEducationMisconfigurationCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)Health (basic)EducationMinorMediumResolved

Mount Diablo Unified School District

bd_deb53de3bd4c0bf0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 27, 2017

Filed

May 19, 2017

To disclose

22 days

Affected

600state residents only

Confidence

66%

Full breach record for Mount Diablo Unified School District →5 incidents on file

Mt. Diablo Unified School District experienced a data breach on April 27, 2017, due to a software caching malfunction in the HomeLink Portal provided by Eagle Soft and Microsoft. For one hour, approximately 600 families could inadvertently view other students' personally identifiable information, including addresses, phone numbers, immunization records, medical history, grades, and transcripts. No financial information or SSNs were exposed. The district took the portal offline, notified law enforcement and the CA AG, and initiated software audits.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 27, 2017 → Notified May 12, 201714d ✓ CA 60-day OK22 days discovery → filing

Incident timeline

discovery → filing · 21 days

Apr 27, 2017

Begins

Apr 27, 2017

Discovered

May 19, 2017

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed600 affectedView incident

Name: Mount Diablo Unified School District
norm: mount diablo unified school district

Name: Mount Diablo Unified School District
norm: mount diablo unified school district
Industry: Educationllm

Discovered: Apr 27, 2017
Breach occurred: Apr 27, 2017 – Apr 27, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 12, 2017
Affected individuals: 600state-resident count only
Data types: PIIIdentity (basic)Health (basic)EducationMinor
Attack vector: Misconfiguration
Regulator citations: Reported the breach to the California Office of the Attorney GeneralNotified law enforcement

During the incident: Immediately took HomeLink offline
Began working with Student Information System provider Eagle Soft and Microsoft
Notified law enforcement
Reported the breach to the California Office of the Attorney General
Changes made: Reviewed existing procedures
Microsoft and Eagle Soft conducting an audit of their software to identify any vulnerability
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: CA 60-day OK · 14d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 27, 2017
→ Notified: May 12, 2017
14d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 27, 2017 → Notified: May 12, 2017	14d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-68975
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 19, 2017
Raw hash: 2b4a2d2571feebe0f18782b629078a92b05fbfb1d2e3146d35b80a47e29ac6cb

Reporting entityMount Diablo Unified School District

Victim entityMount Diablo Unified School District

Incidentdiscovered Apr 27, 2017

Stated responseImmediately took HomeLink offline

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov