North Idaho College

Summary

North Idaho College experienced a cybersecurity incident that prompted an immediate network shutdown to contain the disruption, impacting multiple systems but allowing restoration of critical services within 24 hours. The institution engaged third-party forensic experts for investigation, informed law enforcement, and prioritized remediation while communicating updates to its community as appropriate. This incident aligns with broader targeting of U.S. educational institutions by ransomware groups, which have compromised dozens of colleges and universities this year, often resulting in data exfiltration and operational disruptions.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

North Idaho College experienced a cybersecurity incident in late October or early November 2022 that prompted its information technology team to immediately shut down all college networks as a containment measure. The community college—founded in 1933 and serving approximately 6,000 students in Coeur d'Alene—faced significant operational disruptions due to the network outage, which impacted multiple systems across campus. Critical systems were restored within 24 hours of the shutdown, though the full scope and nature of the incident remained under investigation at the time of reporting on November 3, 2022. The college engaged third-party forensic experts to conduct a thorough investigation and notified law enforcement authorities about the breach. Administrators communicated updates to students and staff while emphasizing their commitment to remediation and future disclosures as the investigation progressed. No specific details about the attack vector, data compromise, or threat actor were disclosed publicly during the initial recovery phase.

This incident occurred amid a surge of ransomware attacks targeting U.S. educational institutions throughout 2022, with at least 35 colleges and universities affected nationwide by November—24 of which confirmed data exfiltration. Community colleges proved particularly vulnerable, with Kellogg Community College canceling multiple class days after a May 2022 ransomware attack and California's College of the Desert suffering a July intrusion affecting 12,500 students. Other impacted institutions included Savannah College of Art and Design (September attack), Austin Peay State University (April ransomware incident), and multiple universities from Florida International to North Carolina A&T. The FBI warned in May 2022 that Russian cybercrime forums contained extensive caches of stolen credentials and VPN accesses belonging to U.S. higher education employees, highlighting systemic vulnerabilities across the sector during this period.

Sources

Sources available to members: 1 source.