Merced High School District Data Breach

Merced Union High School District identified unauthorized activity on its network in August 2025. It did not notify the California Attorney General, or the public, until August 2026, roughly a full year later.

Merced Union High School District, a California public school district, has confirmed a data breach involving student and/or staff personal information. According to the district’s notice letter, sent through the identity-protection vendor Cyberscout, the district identified and responded to unauthorized network activity on August 12, 2025. The district reported the breach to the California Attorney General on August 17, 2026, roughly twelve months after it was identified, the longest breach-to-notice gap Emery | Reddy has tracked in recent months.

Source: California Attorney General data-breach notification list (breach date 08/11/2025, reported 08/17/2026); Merced Union High School District’s Notice of Data Breach letter (Cyberscout).

A Year-Long Gap With No Public Explanation

Merced Union High School District’s own notice states that unauthorized activity was identified and responded to on August 12, 2025, and that notice was not delayed at the request of law enforcement. Neither the district’s letter nor the California Attorney General’s filing explains why nearly a year passed between that date and public disclosure. That gap gives the people affected far less time to watch for signs of fraud than they should have had.

What Information Was Exposed?

According to the district’s notice, the information involved included:

• Name, combined with date of birth
• Social Security number
• In some instances, certain health-related information (varies by individual)

The district has not disclosed a total number of affected individuals, and no independent news coverage of this incident has been located.

How Many People Are Affected?

Merced Union High School District has not disclosed a total population figure. As a public high school district, the affected group likely includes current and former students, parents/guardians, and staff, but no breakdown has been made public.

What Is Merced Union High School District Offering Affected Individuals?

The district is offering free Single Bureau Credit Monitoring, Credit Report, and Credit Score service through Cyberscout, a TransUnion company, for 12 months from the date of enrollment. Affected individuals must enroll within 90 days of the date on their letter at bfs.cyberscout.com/activate using the unique code provided in their notice. Cyberscout representatives are available at 844-593-8313, Monday through Friday, 8 a.m. to 8 p.m. Eastern, for 90 days from the letter date.

Your Information Is at Risk

A Social Security number combined with a date of birth is enough for someone to open new credit, apply for government benefits, or file a fraudulent tax return in another person’s name, and that risk is especially significant for minors, whose Social Security numbers can go unused, and unmonitored, for years before the misuse is discovered. Where health-related information was also involved, affected individuals face the added risk of medical identity theft. Anyone who received a notice letter should enroll in the monitoring being offered, watch for unfamiliar accounts or collection notices, and consider a credit freeze, especially for a minor’s Social Security number.

Do You Have Legal Options?

School districts that collect and store Social Security numbers and health-related information have a legal duty to secure that data and to notify affected individuals without unreasonable delay. Claims against a public school district can also involve additional procedural requirements that do not apply to a private company, so it is worth discussing your options with an attorney promptly.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review if you received a notice letter from Merced Union High School District.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

FAQ

Who is affected by the Merced Union High School District data breach?

The district has not disclosed a total number or breakdown of affected individuals. As a public high school district, those affected likely include current and former students, parents or guardians, and staff.

What information was exposed?

Name combined with date of birth, Social Security number, and, in some instances, certain health-related information that varies by individual, according to the district’s notice letter.

Why did it take a year to find out about this breach?

The district’s notice says unauthorized network activity was identified and responded to on August 12, 2025, but the district did not report the breach to the California Attorney General until August 17, 2026, roughly twelve months later. Neither source has publicly explained the gap.

Is Merced Union High School District offering credit monitoring?

Yes. The district is offering free Single Bureau Credit Monitoring, Credit Report, and Credit Score service through Cyberscout for 12 months, with enrollment required within 90 days of the letter date.

My child’s Social Security number was exposed. Does that matter even though they don’t use credit yet?

Yes, it can matter more, not less. A minor’s Social Security number often goes unused for years, which means fraud can go undetected for a long time before it’s discovered, sometimes not until that person applies for their first credit card or student loan. Parents and guardians of affected students should consider a credit freeze for their child as an added precaution.

Are there special rules for making a claim against a public school district?

Claims against a California public school district can involve additional procedural requirements, such as government claim-presentment deadlines, that don’t apply to claims against a private company. These deadlines can be short, so it’s important to speak with an attorney as soon as possible if you were affected.

Do I have a legal claim?

School districts that collect and store Social Security numbers and health-related information have a legal duty to secure that data and to notify affected individuals without unreasonable delay. If you received a notice letter from Merced Union High School District, contact the Data Breach Attorneys at Emery | Reddy at 206.207.8929 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.