HackingEducationEducationCustomer Data InvolvedData ExfiltratedGovernment IDIdentity (basic)HighContained

Bozeman School District 7

bd_f8eee0e4d5b2fbd7 · schema v1 · pii pii-v2

Severity

High

Discovered

Mar 26, 2026

Filed

Jun 3, 2026

To disclose

10 weeks

Affected · nationwide

2,6172,025 in this filing

Linked

7 filings

Confidence

70%

Full breach record for Bozeman School District 7 →

Bozeman School District #7 notified individuals of unauthorized access to network data between Feb 19 and Mar 27, 2026. Approximately 2,617 individuals were affected, with names and Social Security numbers exposed. The district engaged forensic specialists, secured systems, and offered credit monitoring. Notices were sent June 2, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 35 days

discovery → filing · 10 weeks / 69 days

Feb 19, 2026

Begins

Mar 26, 2026

Discovered

Jun 3, 2026

Filed

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_4ccd7ee71fdf42da2026-06-03Verified
Massachusetts State AGbd_4e0cc705b6897fdd2026-06-03Candidate
New Hampshire State AGbd_7436bd40108784742026-06-03Verified
Vermont State AGbd_7af98d238672fb8a2026-06-03Verified

Show 2 more filings ↓up to 1d gap

Nebraska State AGbd_253765aaf81d5c9b2026-06-02 · +1dVerified
Indiana State AGbd_a98867454db3e3ac2026-06-02 · +1dVerified

Name: Cipriani & Werner
norm: cipriani werner
Domain: c-wlaw.com

Name: Bozeman School District 7
norm: bozeman school district 7
Domain: bsd7.org
Industry: Educationllm

Discovered: Mar 26, 2026
Breach occurred: Feb 19, 2026 – Mar 27, 2026
Undetected for: 35 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 2, 2026
Affected individuals: 2,617state + nationwide
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged third-party computer forensic specialists
Secured systems
Implemented additional technical safeguards
Offered complimentary credit monitoring and identity protection services
Changes made: Reviewed policies and procedures related to data protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Nebraska State AGJun 2 · first

Indiana State AGJun 2 · first

Maine State AG+1d

Massachusetts State AG+1d

New Hampshire State AG+1d

Vermont State AG+1d

Montana State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2026/09/Consumer-notification-letter-37.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 3, 2026
Raw hash: 51020bfeaa205fcda04d392ded7725b053e4a37ea36a2d90689c4e0807de34ba

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityCipriani & Werner

Victim entityBozeman School District 7

Incidentdiscovered Mar 26, 2026

Stated responseEngaged third-party computer forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov