Nueva School Data Breach

The Nueva School says files were accessed and copied from its network in June 2026. Its letters are dated October 30, more than four months after it found the activity.

The Nueva School is a PreK-12 school for gifted students in California. Its notice lists a Hillsborough address. On October 30, 2026, the school sent letters about what it calls a data event, and the incident appears on the California Attorney General’s breach list.

According to the notice, the school became aware of suspicious activity in a limited portion of its network on June 21, 2026. It says it secured the network and hired third-party forensic specialists.

The investigation found that certain files were accessed and copied without authorization between June 13 and June 22, 2026. The school then reviewed those files to learn what personal information they held and who it belonged to. The school says that review was recently completed.

A 131-Day Gap Between Discovery and Notice

The school spent months on what it describes as a comprehensive and time-intensive review of the files. During that time, the people named in those files had not yet received a letter.

• June 13, 2026: Unauthorized access begins
• June 21, 2026: The school becomes aware of suspicious activity
• June 22, 2026: Unauthorized access ends
• October 30, 2026: Date on the notice letters, 131 days after discovery

The notice does not state how many people were affected. It also does not say whether they are students, families, staff or others.

What Information Was Exposed?

The sample letter filed with the state does not list the data types. It leaves a blank field that is filled in for each person. The school says each letter names the types of information found in the affected files for that person, so the letter itself is the best place to check.

The Nueva School says it has no indication that the information has been used to commit identity theft or fraud in relation to this event.

What Is The Nueva School Offering?

The school is offering complimentary identity monitoring through Kroll. The sample letter does not show the length of the offer. Each letter lists the term, a membership number and an activation deadline. Enrollment is at enroll.krollmonitoring.com. The services include credit monitoring, fraud consultation and identity theft restoration.

The school also lists an assistance line at 844.971.8625, Monday through Friday, 8:00 a.m. to 5:30 p.m. Central Time.

Your Information Is at Risk

Files copied from a school network can hold details about both adults and children. The actual risk depends on what each letter lists. Steps that can reduce the risk include:

• Read the letter and note each data type listed
• Enroll in the Kroll offer before the deadline
• Review account statements for suspicious activity
• Check free credit reports at annualcreditreport.com
• Consider a fraud alert or a credit freeze
• Keep the letter and any records of fraud

Do You Have Legal Options?

Schools that collect personal information are expected to safeguard it and to give timely notice when it is exposed. When that does not happen, affected individuals may have legal rights and remedies.

Contact Emery | Reddy today at 916.995.5968 for a Free Case Review. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that collect this information are expected to safeguard it. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

FAQ

How many people were affected by the Nueva School data breach?

The school has not stated a total in its notice.

What information was involved?

It varies by person. The sample letter does not list the data types, so check the list in your own letter.

Why did it take until October to send letters?

The notice says the school needed to complete a review of the affected files. It became aware of the activity on June 21, and letters are dated October 30.

Was my information misused?

The school says it has no indication of identity theft or fraud related to this event. You can still watch your accounts for anything unusual.

What if the letter is about my child?

Children can be attractive targets for identity theft because a problem can go unnoticed for years. Consider these steps:

• Keep the letter
• Ask the credit bureaus how to protect a minor’s credit file
• Call the assistance line in the letter with questions

Could I get scam messages about this incident?

Yes, that is possible. Be careful with any call, text or email that mentions this incident and asks for personal details, passwords or payment. Use the contact information in your letter.

Do I have a legal claim?

You may have legal rights if your information was involved. Schools have a duty to protect the information they collect. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.