Cyber Incident Victim: Buckingham County Public Schools

On or about June 20, 2023, Buckingham County Public Schools, an educational institution located at 1595 West James Anderson Highway in Buckingham, Virginia, experienced a data security incident. The incident was discovered on the same day it occurred. The nature of the breach was identified as a business email compromise. This type of attack typically involves an unauthorized actor gaining access to an organization's email system, though the specific method of access and the exact email accounts involved were not detailed in the public notification. The investigation into the incident determined that the attacker acquired sensitive personal information belonging to a total of 86 individuals. The compromised data included the names of the affected individuals in combination with their driver's license numbers or non-driver identification card numbers. This specific combination of personal identifiers is considered highly sensitive as it can be used for identity theft and other fraudulent activities.

The scope of the incident extended beyond the state of Virginia, with one affected individual being a resident of the state of Maine. The breach notification was formally submitted to the Maine Attorney General's office by outside counsel retained by the school district. The legal firm Woods Rogers Vandeventer Black, PLC, represented the school system in this matter, with Associate Phillip Harmon serving as the point of contact. The submission of this notification to a Maine state authority indicates the school district's compliance with state laws that require organizations to inform regulators and residents when their personal information has been compromised in a security incident, regardless of where the organization itself is based.

In response to the breach, Buckingham County Public Schools undertook a notification process for all 86 affected individuals. The method of notification was written correspondence, which was sent out to the victims on July 21, 2023, approximately one month after the discovery of the incident. This timeframe is consistent with typical incident response processes that involve a period of investigation to determine the full scope of the impact before notifying potential victims. The written notices provided details about the incident and the specific information that was exposed pertaining to each individual. Furthermore, the school district offered mitigation services to all affected persons to help protect them from potential identity theft and fraud resulting from the exposure of their driver's license information.

The protection services were provided by Experian, a major consumer credit reporting agency. The offered service was Experian IdentityWorks, which included a comprehensive suite of monitoring and restoration tools. The affected individuals were provided with 24 months of continuous credit and identity monitoring at no cost to them. This service typically includes features such as credit monitoring at all three major bureaus, identity theft insurance, and access to fraud resolution agents. Importantly, the offering also included full identity restoration services, which are activated in the event that an individual's identity is actually stolen. This service assists victims in the often complex and time-consuming process of recovering their identity and repairing the damage done by fraudsters. The provision of these services represents a significant component of the organizational response aimed at mitigating the potential harm to the affected individuals.

The public notification, filed with the Maine Attorney General, serves as the primary source of factual information regarding this incident. The document confirms the date of the event, the type of attack, the nature of the data exfiltrated, and the remedial actions taken by the school district. The involvement of external legal counsel highlights the procedural and regulatory aspects of managing a data breach, ensuring that all legal obligations for disclosure and consumer protection are met. The incident at Buckingham County Public Schools underscores the ongoing threat that business email compromise attacks pose to organizations of all types, including those in the education sector, and demonstrates the importance of having a response plan that includes timely consumer notification and the provision of protective services to affected individuals.