---
title: "Upland Unified School District network incident"
description: "Upland Unified School District said an unauthorized actor accessed its network around July 4–10, 2026, and possibly viewed or obtained files."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-05"
canonical_url: "https://www.ally.security/incidents/upland-unified-school-district-network-incident-2026"
markdown_url: "https://www.ally.security/incidents/upland-unified-school-district-network-incident-2026.md"
stix_url: "https://www.ally.security/incidents/upland-unified-school-district-network-incident-2026/stix.json"
---

# Upland Unified School District network incident

Upland Unified School District said an unauthorized actor accessed its network around July 4–10, 2026, and possibly viewed or obtained files.

Last modified Nov 5, 2026 · 2 sources

## Summary

- **Environment:** School-district network and files
- **Operational impact:** Personal information potentially viewed or copied
- **Financial impact:** No incident cost publicly quantified

## What happened

[Upland Unified School District](https://www.upland.k12.ca.us/) said an unauthorized actor accessed its network around July 4–10, 2026, and possibly viewed or obtained files. [2](#source-2)

## Impact

The redacted notice identifies full names as potentially involved but conceals the additional recipient-specific fields. It gives no affected-person total. [2](#source-2)

## Timeline

### October 13, 2026 — Affected personal information identified

Affected personal information identified, as described in the [incident notice](https://oag.ca.gov/system/files/UUSD%20Adult%20CM%20Redacted.pdf). [2](#source-2)

### November 3, 2026 — Notification letter dated

Notification letter dated, as described in the [incident notice](https://oag.ca.gov/system/files/UUSD%20Adult%20CM%20Redacted.pdf). [2](#source-2)

### November 5, 2026 — Briefing updated

This briefing was last reviewed and updated on November 5, 2026.

## Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

The district detected suspicious activity around July 10, engaged cybersecurity specialists, and determined on October 13 that personal information was in the affected data. [2](#source-2)

Its November 3 letter offered 12 months of credit monitoring and described continuing security improvements. [2](#source-2)

The [California registry](https://oag.ca.gov/ecrime/databreach/reports/sb24-632351) lists July 2 as the breach date, whereas the letter gives an approximate July 4–10 access window; the reviewed records do not resolve that difference. [1](#source-1) [2](#source-2)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/upland-unified-school-district-network-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### California breach registry: Upland Unified School District

regulatory · California Attorney General

<https://oag.ca.gov/ecrime/databreach/reports/sb24-632351>

<a id="source-2"></a>

### Upland Unified School District notice of data breach

official · Upland Unified School District · Nov 3, 2026

<https://oag.ca.gov/system/files/UUSD%20Adult%20CM%20Redacted.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Upland Unified School District network incident: The redacted notice identifies full names as potentially involved but conceals the additional recipient-specific fields. It gives no affected-person total.
2. **Resulted In · 100% confidence · current**  
   Upland Unified School District network incident: Its November 3 letter offered 12 months of credit monitoring and described continuing security improvements.
3. **Resulted In · 100% confidence · current**  
   Upland Unified School District network incident: The California registry lists July 2 as the breach date, whereas the letter gives an approximate July 4–10 access window; the reviewed records do not resolve that difference.
4. **Resulted In · 100% confidence · current**  
   Upland Unified School District network incident: The district detected suspicious activity around July 10, engaged cybersecurity specialists, and determined on October 13 that personal information was in the affected data.
5. **Occurred At · 100% confidence · current**  
   Notification letter dated: 2026-11-03
6. **Affected Organization · 100% confidence · current**  
   Upland Unified School District network incident: Upland Unified School District
7. **Resulted In · 100% confidence · current**  
   Upland Unified School District network incident: Upland Unified School District said an unauthorized actor accessed its network around July 4–10, 2026, and possibly viewed or obtained files.
8. **Resulted In · 100% confidence · current**  
   Upland Unified School District network incident: Notification letter dated
9. **Resulted In · 100% confidence · current**  
   Upland Unified School District network incident: Affected personal information identified
10. **Occurred At · 100% confidence · current**  
   Affected personal information identified: 2026-10-13

</details>