HackingEducationEducationVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)CredentialsLowResolved

Kingsburg Elementary Charter

bd_faa22a41a5be53fa · schema v1 · pii pii-v1

Severity

Low

Discovered

May 12, 2020

Filed

May 19, 2020

To disclose

7 days

Affected

Not disclosed

Confidence

65%

Full breach record for Kingsburg Elementary Charter →

Kingsburg Elementary Charter School District experienced unauthorized access to its Student Information System (Aeries SIS) in November 2019 due to a software vulnerability. The breach was discovered on May 12, 2020, after notification from the software vendor. Affected data included student and parent names, addresses, emails, and passwords. No financial or SSN data was compromised. The district mandated password resets and worked with law enforcement, who have since taken perpetrators into custody.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 12, 2020 → Notified May 14, 20202d ✓ CA 60-day OK7 days discovery → filing

Incident timeline

undetected · 193 days

discovery → filing · 7 days

Nov 1, 2019

Begins

May 12, 2020

Discovered

May 19, 2020

Filed

vs. sector median

8 wks faster

Part of Aeries supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Kingsburg Elementary Charter
norm: kingsburg elementary charter
Domain: kesd.org

Name: Kingsburg Elementary Charter
norm: kingsburg elementary charter
Domain: kesd.org
Industry: Educationllm

Discovered: May 12, 2020
Breach occurred: Nov 1, 2019 – Nov 30, 2019
Undetected for: 193 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 14, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified California Attorney General
Third party: via Aeries Software
Initial access: exploit_public_facing

During the incident: Immediately ran security checks and reviewed logs
Instituting a mandatory password reset for all parent and student accounts
Working with Aeries and law enforcement where appropriate
Changes made: Patched the vulnerability in the Aeries Student Information System software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: CA 60-day OK · 2d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 12, 2020
→ Notified: May 14, 2020
2d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 12, 2020 → Notified: May 14, 2020	2d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-190160
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 19, 2020
Raw hash: 16658d9f252b994403d652dc1bb49898ad49e38ddb3e9511ddb8e30315a5c965

Reporting entityKingsburg Elementary Charter

Victim entityKingsburg Elementary Charter

Incidentdiscovered May 12, 2020

Stated responseImmediately ran security checks and reviewed logs

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov