HackingEducationEducationVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)CredentialsLowContained

Fairfield-Suisun Unified School District

bd_f94bf65c1bc40596 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2019

Filed

Jun 8, 2020

To disclose

31 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Fairfield-Suisun Unified School District →

Fairfield-Suisun Unified School District notified parents that an unauthorized individual exploited a vulnerability in the Aeries Student Information System software. The incident occurred on November 4, 2019, and was discovered in late November 2019. Affected data included parent/student names, addresses, phone numbers, and login credentials (email and hashed passwords). The district implemented mandatory password resets and installed a software patch provided by Aeries.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 1, 2019 → Notified May 6, 2020187d ✗ CA 60-day late31 weeks discovery → filing

Incident timeline

Nov 4, 2019

Begins

Jun 8, 2020

Filed

vs. sector median

+23 wks slower

Part of Aeries supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Fairfield-Suisun Unified School District
norm: fairfield suisun unified school district
Domain: fsusd.community.highbond.com

Name: Fairfield-Suisun Unified School District
norm: fairfield suisun unified school district
Domain: fsusd.community.highbond.com
Industry: Educationllm

Discovered: Nov 1, 2019
Breach occurred: Nov 4, 2019
Materiality determined: —
Notification sent: May 6, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Third party: via Aeries
Initial access: exploit_public_facing

During the incident: Implemented a mandatory password reset for all parent and student portal accounts
Installed the software patch that Aeries made available to remedy the vulnerability
Working with Aeries to review existing policies and procedures
Changes made: Installed the software patch that Aeries made available to remedy the vulnerability
Working with Aeries to review existing policies and procedures to mitigate any risk associated with this incident and to better prevent future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(220 days from discovery to filing)
Compliance flags: CA 60-day late · 187d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 1, 2019
→ Notified: May 6, 2020
187d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 1, 2019 → Notified: May 6, 2020	187d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190718
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 8, 2020
Raw hash: 41dae0df6021f9452e038b817040878e9a4e3bcf29ea2374f2fc59198e099f05

Reporting entityFairfield-Suisun Unified School District

Victim entityFairfield-Suisun Unified School District

Incidentdiscovered Nov 1, 2019

Stated responseImplemented a mandatory password reset for all parent and student portal accounts

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov