Clackamas Community College

Summary

Clackamas Community College faced a class-action lawsuit alleging it failed to protect student data by storing names, dates of birth, tax identification numbers, passport numbers, financial accounts and health information in an unencrypted, Internet-accessible environment. An unauthorized party accessed college systems and acquired files, prompting the institution to investigate and later notify affected individuals. The notice described suspicious activity on a user account that was reset, followed by additional anomalous behavior that led to network containment efforts and the engagement of a forensic security firm. The college offered impacted persons one year of credit monitoring and identity theft protection, while the suit seeks compensatory and punitive damages and requests at least ten years of credit monitoring for those affected. At least one hundred individuals are part of the alleged class, and the plaintiff reported a rise in spam calls believed to stem from the breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 10, the college’s security team identified suspicious activity linked to a user account on its computer network and promptly reset the account. On October 24, additional suspicious activity was detected, prompting the institution to work on containing its network to prevent further interference. A forensic security firm was subsequently engaged to investigate the incidents and assess the security of the network. The investigation determined that an unauthorized third party accessed a small number of systems and acquired files from those systems in late October.

The compromised data included students’ names, dates of birth, tax identification numbers, passport numbers, financial account information, and health details. Following the breach, the college delayed notification until January of the following year, after which it sent notices to affected individuals on January 8. The named plaintiff, Aidan Zahn, reported a noticeable increase in spam calls that he attributes to the exposure of his personal information. The lawsuit alleges that at least 100 individuals constitute the proposed class, and it is one of three similar actions filed against the college since the start of the year that are likely to be consolidated before U.S. Magistrate Judge Jolie A. Russo.

In its notice, the college offered those impacted the opportunity to enroll in one year of credit monitoring and identity theft protection services. The suit seeks unspecified compensatory and punitive damages and requests a court order requiring the college to provide no less than ten years of credit monitoring services for the affected individuals. The college’s counsel, Curt Roy Hinelin, was granted until mid‑March to respond to the litigation after requesting additional time to investigate the allegations. A spokesperson for the institution did not immediately comment on the suit when contacted.

Sources

Sources available to members: 1 source.