Cyber Incident Victim: Cabrillo College
Date:
May 2024
Location:
United States of America
Summary
Cabrillo College experienced an external hacking incident compromising personal data, including names combined with other identifiers, affecting over 18,000 individuals. The breach prompted written notifications to impacted parties and the provision of 12 months of credit monitoring and identity protection services through TransUnion. A small subset of victims included Maine residents, though the majority of those affected resided elsewhere. The institution engaged legal counsel to manage breach disclosures and mitigation efforts following the unauthorized system access.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 12, 2024, Cabrillo College, an educational institution located at 6500 Soquel Drive in Aptos, California, experienced an external system breach resulting from hacking activity. The incident compromised the personal information of 18,163 individuals, including three Maine residents. The breach remained undetected for over seven months until its discovery on December 11, 2024. Attackers acquired names combined with other personal identifiers during the intrusion, though the specific types of additional compromised data elements were not detailed in the notification. The delayed discovery timeline indicates the breach persisted without detection for an extended period, exposing affected individuals to potential identity theft risks during this interval.
Cabrillo College initiated written notifications to all impacted individuals on January 27, 2025, with Maine residents receiving a specific notice documented in the file Cabrillo_Exhibit_A.pdf. The institution offered affected persons 12 months of credit monitoring and identity protection services through TransUnion as remedial support. Legal counsel Kathleen A. Monaghan of Cipriani & Werner, P.C. submitted the breach disclosure to Maine authorities, confirming no separate breach notifications had been issued by the college within the preceding 12-month period. The structured response focused on consumer notification and protection services rather than public disclosure of technical containment measures or forensic findings regarding the attack methodology.