---
title: "The Nueva School network-file theft"
description: "The Nueva School detected suspicious network activity on June 21, 2026. Investigators found files had been accessed and copied without authorization between June 13 and June 22."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-04"
canonical_url: "https://www.ally.security/incidents/nueva-school-network-file-theft-2026"
markdown_url: "https://www.ally.security/incidents/nueva-school-network-file-theft-2026.md"
stix_url: "https://www.ally.security/incidents/nueva-school-network-file-theft-2026/stix.json"
---

# The Nueva School network-file theft

The Nueva School detected suspicious network activity on June 21, 2026. Investigators found files had been accessed and copied without authorization between June 13 and June 22.

Last modified Nov 4, 2026 · 1 source

## Summary

- **Environment:** School network files
- **Operational impact:** Personal information accessed and copied
- **Financial impact:** No incident cost disclosed

## What happened

[The Nueva School](https://www.nuevaschool.org/) detected suspicious network activity on June 21, 2026. Investigators found files had been accessed and copied without authorization between June 13 and June 22. [1](#source-1)

## Impact

Affected files contained names and additional personal information. The public template leaves recipient-specific data categories blank, so it does not establish the complete set of exposed fields. [1](#source-1)

## Timeline

### June 13, 2026 — Unauthorized file access begins

Unauthorized file access begins, according to the published account. [Incident notice](https://oag.ca.gov/system/files/The%20Nueva%20School%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf). [1](#source-1)

### June 21, 2026 — Suspicious activity discovered

Suspicious activity discovered, according to the published account. [Incident notice](https://oag.ca.gov/system/files/The%20Nueva%20School%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf). [1](#source-1)

### June 22, 2026 — Reported access window ends

Reported access window ends, according to the published account. [Incident notice](https://oag.ca.gov/system/files/The%20Nueva%20School%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf). [1](#source-1)

### October 30, 2026 — Notification letter dated

Notification letter dated, according to the published account. [Incident notice](https://oag.ca.gov/system/files/The%20Nueva%20School%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf). [1](#source-1)

### November 4, 2026 — Briefing updated

This briefing was last reviewed and updated on November 4, 2026.

## Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Nueva secured its network, engaged forensic specialists, reviewed affected files and added security measures. It offered identity monitoring and reported no indication of related identity theft or fraud. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/nueva-school-network-file-theft-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### The Nueva School data security notice

official · The Nueva School · Oct 30, 2026

<https://oag.ca.gov/system/files/The%20Nueva%20School%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   The Nueva School network-file theft: Notification letter dated
2. **Occurred At · 100% confidence · current**  
   Suspicious activity discovered: 2026-06-21
3. **Resulted In · 100% confidence · current**  
   The Nueva School network-file theft: Unauthorized file access begins
4. **Resulted In · 100% confidence · current**  
   The Nueva School network-file theft: The Nueva School detected suspicious network activity on June 21, 2026. Investigators found files had been accessed and copied without authorization between June 13 and June 22.
5. **Resulted In · 100% confidence · current**  
   The Nueva School network-file theft: Suspicious activity discovered
6. **Occurred At · 100% confidence · current**  
   Reported access window ends: 2026-06-22
7. **Resulted In · 100% confidence · current**  
   The Nueva School network-file theft: Affected files contained names and additional personal information. The public template leaves recipient-specific data categories blank, so it does not establish the complete set of exposed fields.
8. **Discovered At · 100% confidence · current**  
   The Nueva School network-file theft: 2026-06-21
9. **Occurred At · 100% confidence · current**  
   Notification letter dated: 2026-10-30
10. **Resulted In · 100% confidence · current**  
   The Nueva School network-file theft: Reported access window ends
11. **Occurred At · 100% confidence · current**  
   Unauthorized file access begins: 2026-06-13
12. **Affected Organization · 100% confidence · current**  
   The Nueva School network-file theft: The Nueva School
13. **Resulted In · 100% confidence · current**  
   The Nueva School network-file theft: Nueva secured its network, engaged forensic specialists, reviewed affected files and added security measures. It offered identity monitoring and reported no indication of related identity theft or fraud.

</details>