Provo City School District

Summary

A phishing attack compromised the Provo City School District, exposing personal information of 1,037 employees—approximately half of its staff—including names, dates of birth, and Social Security numbers. While no student data was accessed, the breach created potential identity theft risks, though investigators found no conclusive evidence the stolen data was copied or exfiltrated. The incident underscored vulnerabilities in employee awareness, with district officials confirming the breach targeted staff records exclusively.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In October 2014, Provo City School District experienced a data breach impacting 1,037 employees, representing approximately half of its workforce. An unidentified attacker gained access to the district's systems through a phishing attack, though the specific employee targeted by the phishing attempt was not disclosed. The compromised information included employee names, dates of birth, and Social Security numbers, with the possibility that additional data types were exposed. District officials confirmed through Caleb Price, communications coordinator, that exclusively employee information was accessed and that no student records were compromised. The breach did not involve direct theft of student educational or personal data. While investigators determined unauthorized access occurred, they found no conclusive evidence that the attacker copied or extracted the exposed employee records from district systems.

The district publicly acknowledged the incident through local media, emphasizing the limitation to staff information while addressing identity theft concerns stemming from the exposure of sensitive identifiers. No technical details about the compromised systems or detection methods were disclosed. Response efforts focused on organizational measures rather than technical containment, with explicit recognition of the need for enhanced employee training to improve phishing email recognition. The district did not confirm whether implemented training occurred before or after the breach. Uncertainty persisted regarding whether attackers retained accessed data, leaving affected employees at potential risk of identity theft until forensic analysis could conclusively determine data exfiltration status. No further updates regarding investigation outcomes or post-incident verification were provided in the available reporting.

Sources

Sources available to members: 1 source.