Centinela Valley Union High School District

Summary

Centinela Valley Union High School District experienced a phishing incident where an employee received a fraudulent email impersonating another staff member, resulting in unauthorized access to W-2 forms containing sensitive employee data such as names, addresses, Social Security numbers, and wage details. The district promptly initiated an investigation upon discovery, notified relevant tax authorities and law enforcement agencies, and is cooperating with ongoing investigations to address the breach and mitigate potential impacts on affected individuals.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 31, 2019, the Centinela Valley Union High School District in California discovered a phishing incident targeting employee data. An unauthorized individual sent a deceptive email impersonating a district employee to another staff member, successfully tricking the recipient into disclosing sensitive information. The district initiated an immediate investigation upon identifying the breach to assess its scope and determine what data was compromised. They coordinated with federal law enforcement authorities and reported the incident to the IRS and state tax boards to facilitate a joint response. The investigation confirmed that the attacker potentially accessed IRS Form W-2 details for district employees, which included full names, home addresses, Social Security numbers, and comprehensive 2018 wage records. The district sent an initial email notification to affected personnel on the same day the breach was detected, followed by supplemental communications to provide further incident details.

The compromised W-2 data exposed employees to risks of identity theft and tax fraud due to the sensitivity of the information involved. While the district had 614 employees during the 2008-2009 academic year, the exact number of individuals impacted in 2019 remained unspecified in available disclosures. The district issued a formal notification to California state regulators outlining the breach timeline, attacker methodology, and categories of exposed data. No evidence suggested broader system infiltration beyond the phishing-induced W-2 disclosure. Affected employees received guidance to monitor their financial accounts and tax filings for signs of misuse, though specific remediation measures like credit monitoring were not detailed in public reports. The district emphasized ongoing cooperation with investigative agencies but did not disclose additional containment measures or long-term mitigation strategies.

Sources

Sources available to members: 1 source.