Cyber Incident Victim: Illinois Valley Community College
Date:
Apr 2020
Location:
United States of America
Summary
Illinois Valley Community College experienced a disruptive computer hack that resulted in the shutdown of critical systems including email, student registration, and payroll operations. College administrators engaged a private company to resolve the issue, expressing confidence that systems could be restored within ten days, though financial implications remained unclear at the time. The incident prompted an emergency board meeting to address operational challenges, with officials refraining from explicitly labeling the event as a ransomware attack during initial assessments.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On Friday, April 23, 2020, Illinois Valley Community College (IVCC) discovered a computer hack that disrupted critical operational systems. The incident immediately rendered email services, class registration platforms, and payroll processing inaccessible, causing significant operational interruptions. College administrators convened an emergency board meeting on Saturday, April 25, to address the crisis, during which Vice President for Business Services and Finance Cheryl Roelfsema emphasized the urgency of restoring systems. IVCC engaged a private company to resolve the issue, expressing confidence that systems could be "unlocked" within ten days, though the financial cost remained undetermined at the time. The disruption directly impacted institutional functions, including employee compensation through payroll outages and student services through registration system failures.
The college did not publicly characterize the attack as ransomware during the initial response phase, though the description of systems being "locked" and requiring external intervention suggested a potential ransomware scenario. Critical infrastructure remained offline, forcing the institution to operate without essential digital tools for communication, academic planning, and financial operations. The payroll outage risked delaying staff payments, while the registration system failure obstructed student enrollment processes. IVCC's response centered on contracting external expertise for system recovery, with no immediate public disclosure regarding investigation methods, threat actor attribution, or evidence of data exfiltration. The incident underscored the institution's dependence on third-party remediation without clarifying whether data backups or contingency plans mitigated the disruption.