Cyber Incident Victim: Ronald E. McNair High School
Date:
Feb 2020
Location:
United States of America
Summary
A data breach at Ronald E. McNair High School and another institution involved unauthorized access to three staff members' electronic grade books, compromising student names, addresses, parent contact details, grades, attendance records, and medical information. The incident, which did not involve ransomware, exposed data potentially protected under FERPA, with no evidence of misuse identified during the investigation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 15, 2020, the Lodi School District publicly disclosed a data breach impacting Ronald E. McNair High School and Bear Creek High School. Unauthorized individuals gained access to electronic grade books belonging to three staff members across these institutions. The compromised systems contained sensitive student records including full names, home addresses, parent or guardian contact details, academic grades, attendance histories, and medical information. This dataset included elements protected under the Family Educational Rights and Privacy Act (FERPA), though the specific medical data types were not detailed in available reports. District officials confirmed the incident did not involve ransomware and stated no evidence indicated misuse of the exfiltrated information. The breach discovery timeline and initial intrusion vectors were not disclosed publicly.
Lodi School District initiated an investigation following the breach detection, though investigative methods and participating agencies remained unspecified. No containment measures, system modifications, or forensic findings were reported beyond the confirmation of unauthorized grade book access. Public notification occurred through a CBS media report, with no corroborating statements or incident details published on district or school websites. The breach scope was confined to three staff accounts, but the total number of affected students across both schools was not quantified. No legal, financial, or operational consequences were documented in available sources, and district officials maintained no evidence of data misuse existed as of the reporting date. Media coverage remained limited to the initial CBS disclosure without follow-up reports or regulatory filings.