MalwareEducationEducationRansomwareData ExfiltratedRansom DemandedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighActive

Lakewood School District

bd_e09ae07ace86fbe9 · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 27, 2026

Filed

May 29, 2026

To disclose

5 weeks

Affected

1,006state residents only

Confidence

71%

Full breach record for Lakewood School District →

Lakewood School District (WA) reported a ransomware incident where an unauthorized actor accessed the network between March 19 and April 27, 2026. The breach affected 1,006 Washington residents, exposing names, SSNs, driver's license numbers, and health savings account information. Lakewood engaged third-party investigators, notified the FBI, and sent notifications on May 29, 2026, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 39 days

discovery → filing · 5 weeks / 32 days

Mar 19, 2026

Begins

Apr 27, 2026

Discovered

May 29, 2026

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,006 affectedView incident

Name: Lakewood School District
norm: lakewood school district

Name: Lakewood School District
norm: lakewood school district
Industry: Educationllm

Discovered: Apr 27, 2026
Breach occurred: Mar 19, 2026 – Apr 27, 2026
Undetected for: 39 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 29, 2026
Affected individuals: 1,006state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberDriver's licence numberFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General

During the incident: Took measures to secure its systems
Engaged third-party cybersecurity firms to assist with an investigation
Notified the FBI
Changes made: Implemented additional measures to enhance its existing network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA41103.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2026
Raw hash: 09c76e8333b3ce60a71c5274ae2c03cdb476e5e2e24a03e6c353315893b655bb

Reporting entityLakewood School District

Victim entityLakewood School District

Incidentdiscovered Apr 27, 2026

Stated responseTook measures to secure its systems

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com