Saddleback Valley Unified School District

Illuminate Education, a technology provider for schools, notified Orange Unified School District of a data security incident. Unauthorized access occurred between December 28, 2021, and January 8, 2022. The incident involved student data including names, academic records, and special education information. No SSNs or financial data were compromised. Illuminate contained the breach and offered credit monitoring.

Saddleback Valley Unified School District (SVUSD) disclosed a data security incident involving its Aeries Student Information System (SIS). The breach occurred on November 4, 2019, and was discovered by SVUSD on April 27, 2020, following notification from the software provider, Aeries. The incident involved unauthorized access to on-premise databases containing parent and student login information, physical addresses, email addresses, and encrypted passwords. SVUSD reset passwords for all affected accounts and implemented stricter password policies. Law enforcement was notified, and charges were filed against responsible parties.

Laguna Beach Unified School District (LBUSD) disclosed a data breach involving its Aeries Student Information System. An unauthorized individual exploited a vulnerability in the Aeries software in late November 2019, gaining access to student and parent data including names, addresses, emails, and hashed passwords. LBUSD confirmed the breach on May 14, 2020, after Aeries identified the exploit. Over 150 California school districts were impacted. LBUSD required password changes, installed a software patch, and disabled inactive accounts. Law enforcement investigated and identified the suspect.

Total Registration LLC, a third-party service provider for exam registration, experienced a data security incident due to a misconfigured Amazon S3 file storage server. The misconfiguration allowed potential unauthorized access to student registration information (names, dates of birth, addresses, phone numbers, student IDs) for students who registered for AP exams between June 2016 and April 2019. The issue was discovered on April 11, 2019, by a security researcher and remediated by April 12, 2019. No evidence of actual unauthorized access by third parties was found. Social Security numbers, credit card data, and medical information were not involved.