Eureka City Schools data breach: names and Social Security numbers in files accessed September 25

What happened at Eureka City Schools?

ECS found unusual activity in its network on September 25, 2026, contained it, and brought in outside computer specialists to investigate. The investigation found that files were accessed that same day. A second team then went through the files to see what information they held and whom it concerned, and finished on October 20, 2026. The letter does not say how the intruder got in, whether files were copied or only viewed, or whether ransomware was involved.

Date	What happened	Source
September 25, 2026	Unusual activity found; files accessed the same day	Notice letter, California AG record
October 20, 2026	Review of the files finished	Notice letter
November 6, 2026	Letter date	Notice letter
February 26, 2027	Last day to enrol in Experian monitoring	Notice letter

California's record gives September 25, 2026 as the date of the breach. From the activity to the letters took six weeks, of which the file review took almost four. The guide to how long organizations take to notify sets that against other letters in this log.

Whose information was involved?

The letter names two items for each recipient: name and Social Security number. It does not say whether the people involved are staff, former staff, contractors or someone else. The only group it rules out is students, by placing the files outside the student data store. The letter also tells readers to check explanation of benefits forms for errors, though it lists no health or insurance information as involved. The guide to school and education breach notices compares what other districts and schools have told families.

What is Eureka City Schools offering?

Twelve months of credit monitoring and identity protection through Experian, at no cost. ECS cannot switch it on for anyone, so each recipient has to enrol with the code in the letter. The code stops working after 11:59 pm UTC on February 26, 2027. The guide to credit-monitoring offers in breach letters compares this term with others.

Was my information in the Eureka City Schools data breach?

Only the letter answers that: ECS wrote to the people whose names and Social Security numbers were in the accessed files. The sample letter filed with California leaves the call-center number and hours blank, so a recipient's own letter is the place to find them. ECS says it also notified the relevant state regulators. For someone with a Social Security number exposed, the letter's own advice is to watch credit reports and account statements and to call the bank or card company about anything unusual.

What the notice leaves open

• How many people received letters: no count on the letter or on California's record.
• How the intruder got in, and whether the files were copied.
• Who the affected people are, beyond not being students.
• ECS says it has strengthened its security and added policies, without saying what changed.

The guide to reading a California notice explains what the attorney general's record does and does not add to a letter like this one.