David Douglas School District Data Breach Notice (Oregon Attorney General)

The David Douglas School District notified 6,820 people that their personal information was exposed in an incident that occurred on December 21, 2024. The filing reached the Oregon Department of Justice on March 12, 2025 — an interval of 81 days.

Personal information from school records now sits outside the district’s control

If you received a notification letter from David Douglas School District, the filing confirms that categories of personal information tied to you were included in the December 21 incident. The record lists personal information as the exposed category. No passwords, no financial account numbers, and no permanent government identifiers such as Social Security numbers appear in the filing.

That absence is meaningful. Because no credentials were exposed, this incident does not require you to change any David Douglas account password. The risk centers on the long-term value of the personal details that were taken.

What personal information from a school district actually enables

School records typically contain names, dates of birth, addresses, and parent or guardian contact details. When these leave a district’s systems, they become building blocks for identity-related fraud. A date of birth combined with a current or former address and parent names can help someone attempt to open accounts, file fraudulent tax returns, or impersonate a family member in low-level government or benefits processes.

Unlike a credit card, a date of birth cannot be canceled or reissued. An address history cannot be erased. These facts remain useful to fraudsters for years because they help pass knowledge-based authentication questions that many institutions still rely on.

The 81-day gap between incident and notification

The breach happened on December 21, 2024. The district filed its notice 81 days later on March 12, 2025. Notification timelines vary by state law and by when an internal investigation concludes. The record does not disclose when the district discovered the incident or how long any unauthorized access may have lasted. What matters to you is that the filing is now public and the district is required to contact the individuals whose records were affected.

How to determine whether this filing includes you

The district must notify affected individuals directly, usually by mail sent to the address it has on file. If you have not received a letter, it is likely your information was not part of the group of 6,820 records. However, if you or your child moved at any time after December 21, 2024, the letter may have gone to an old address. In that case, contact the district’s privacy or records office directly to confirm whether your information was involved.

The records that cannot be changed

The filing does not list Social Security numbers or other reissuable identifiers. That limits some of the worst-case outcomes. Still, the combination of name, date of birth, and address history is enough to fuel many common fraud attempts. These pieces of information retain their value long after the news cycle moves on.

What this means for your family’s ongoing exposure

Children’s records are especially sensitive because a stolen date of birth and name can be used years later when that child applies for their first credit card, student loans, or driver’s license. Early monitoring matters. The exposure does not mean fraud has already occurred, only that the raw material for it is now in unknown hands.

Because the record lists only personal information and nothing stronger, the practical risk is identity theft rather than immediate account takeover. That distinction matters. It tells you where to focus your attention instead of chasing every possible threat.

Concrete steps that address this specific exposure

• Place a free fraud alert with the three major credit bureaus. This forces lenders to verify your identity before opening new accounts in your name or your child’s name. It lasts one year and can be renewed.
• Review your credit reports now and again in six months. Look for accounts you do not recognize. Since no Social Security number is confirmed exposed, the risk of new credit lines is lower, but checking remains the clearest way to catch misuse.
• Monitor explanations of benefits and school-related mail. Watch for any unexpected communications from government agencies, tax authorities, or healthcare providers that reference your family members.
• Tell your older children not to share personal details when asked by phone or email. Many school-related scams begin with someone claiming to be from the district and requesting verification data that is now more valuable.
• File your taxes early each year. This reduces the window in which someone could file a fraudulent return using a child’s information.

The letter from David Douglas School District is the most reliable indicator of whether you are in the affected group. The 6,820 individuals named in the filing have been or will be contacted. For everyone else, this incident does not change their risk profile. For those who were notified, the exposure is real but contained to personal details that require steady, unspectacular vigilance rather than panic.