State Auditor's School District Data Breach Hotline

*First Name:

*Last Name:

*Title:

*Phone Number:

*Email Address:

*School District Name:

*Street Address 1:

Street Address 2:

*City:

*State: Alabama Alaska Arizona Arkansas California Colorado Connecticut Delaware Florida Georgia Hawaii Idaho Illinois Indiana Iowa Kansas Kentucky Louisiana Maine Maryland Massachusetts Michigan Minnesota Mississippi Missouri Montana Nebraska Nevada New Hampshire New Jersey New Mexico New York North Carolina North Dakota Ohio Oklahoma Oregon Pennsylvania Rhode Island South Carolina South Dakota Tennessee Texas Utah Vermont Virginia Washington West Virginia Wisconsin Wyoming

*Zip Code (5 Digits):

*Has the district already notified the Department of Elementary and Secondary Education, i.e. through their reporting form?

Please use the "Incident Description" field below to provide a narrative of the incident, including (as applicable):

• When the incident began
• When and how the incident was detected
• A general summary of the cause or circumstances enabling the incident
• The scope and scale of the incident (use estimates as needed):
  • Affected parties
  • Number of records
  • Time span of records
  • Presence of directory information versus personally identifiable information; see 34 CFR Section 99.3 as well as Section 407.1500(9), RSMo
• The current status of the incident and activities remaining:
  • Whether the cause or circumstances enabling the incident were resolved (i.e. improvement of controls or processes to avoid repeat situations)
  • Whether external parties were notified as applicable (i.e. affected individuals/families, law enforcement)
• Discussion of the following considerations, if applicable:
  • Has the district internally created any policies, procedures, or plans regarding security incident response and/or data breach response? These would be beyond the adoption of Missouri School Board Association policies EHBC and EHBC-AP(1). If "yes" please provide copies.
  • Did the incident involve any element of legitimacy (i.e. abuse or error by an employee in a position of trust; error in recurring practices or transmissions)?
  • Were all relevant user accounts, especially those accessible outside the district's network (i.e. home or mobile web access), disabled (locked, etc.) as necessary?

*Incident Description: