Upland Unified School District says an intruder was in its network from July 4 to July 10, 2026

When did the Upland Unified data breach happen?

The district says it became aware of activity pointing to possible unauthorized access to its network on or about July 10, 2026. It worked with outside cybersecurity professionals to find out how far the incident went and which data it touched. On October 13, 2026, after a document review, it determined whose personal information was in the files that may have been viewed or copied.

The California Attorney General's record lists July 2, 2026 as the date of the breach, two days earlier than the start date in the letter. The filing does not explain the difference.

Step	Date
Date of breach on the AG record	July 2, 2026
Network accessed (per the letter)	on or about July 4 to July 10, 2026
District becomes aware	on or about July 10, 2026
Affected people identified	October 13, 2026
Letter dated and filed with California's attorney general	November 3, 2026
Last day to enroll in credit monitoring (90 days from the letter)	February 1, 2027

The letter is dated 116 days after the district noticed the activity, and 21 days after it identified whose data was involved. That sequence matches other California districts on this site. Alisal Union School District noticed unusual activity on or around June 22, 2026 and filed on October 7. Tulare Joint Union High School District identified unauthorized activity on August 28, 2026 and filed on October 13. How long companies take to notify after a breach measures that gap across the site's record.

What information was taken in the Upland Unified breach?

The filed copy says the information includes the recipient's full name, and the rest of that sentence is blacked out. Other data types are not readable in the public copy. The district says it has no evidence that anyone's information has been used for identity theft or financial fraud.

The sample on the AG record is titled "UUSD Adult CM Redacted". The filing does not say whether students, parents or staff were among those affected, or whether minors received a different letter.

What does Upland Unified offer, and how do you enroll?

Enrollment is online at bfs.cyberscout.com/activate with the code printed in the letter. Recipients must enroll within 90 days of the letter's date, which puts the deadline at February 1, 2027. Signing up needs an internet connection and an email account, and the service may not be available to anyone under 18.

Anyone who freezes their credit before enrolling has to lift the freeze to sign up, and can freeze again afterwards. The letter recommends a free one-year fraud alert, placed by calling any one of the three bureaus. Questions go to 1-844-772-7149, Monday through Friday, 8am to 8pm Eastern Time, excluding major U.S. holidays. Credit monitoring offers in breach notice letters compares this offer with others on the site.

What Massachusetts recorded

Massachusetts' Office of Consumer Affairs and Business Regulation lists a report from Upland Unified School District dated November 4, 2026, the day after the letter's date (breach 2026-1925): 3 Massachusetts residents affected. The only category it marks as breached is Social Security numbers. That count covers Massachusetts residents only; the district's letter gives no total.

What the notice leaves open

The letter does not say how many people were affected. Its only count is for Rhode Island, which it puts at zero. It does not say how the intruder got in, whether ransomware was involved, or who was behind it. School and education breach notices sets out what other districts' letters disclose on those points.