Cyber Incident Victim: Eastern Maine Community College
Date:
Aug 2018
Location:
United States of America
Summary
Eastern Maine Community College experienced a malware infection affecting certain computers, potentially compromising personal information of current and former students and employees. The breach could have exposed usernames, passwords, Social Security numbers, and dates of birth for approximately 42,000 individuals spanning multiple decades of enrollment and employment. The institution notified affected parties, offered complimentary credit monitoring and identity restoration services, and collaborated with federal investigators to address the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On August 17, 2018, Eastern Maine Community College (EMCC) in Bangor publicly disclosed a potential data breach affecting current and former students and employees. The college confirmed that certain institutional computers had been infected with malware, creating vulnerabilities that may have enabled unauthorized access to sensitive information. The incident impacted individuals associated with EMCC across a 20-year span, with student records dating back to 1998 and faculty records extending to 2008 exposed to potential compromise. Data at risk included usernames, passwords, dates of birth, and Social Security numbers—critical personally identifiable information that could facilitate identity theft or financial fraud. While the exact duration of system exposure and method of malware intrusion were not specified, the breach represented a significant compromise of institutional data security affecting multiple generations of the college community.
EMCC initiated notifications to approximately 42,000 potentially affected individuals following the discovery of the malware infection. The college offered free credit monitoring and identity restoration services to mitigate potential harm stemming from the exposure of sensitive personal data. Officials collaborated with federal investigative agencies to address the incident, though no specific law enforcement partners were named in public communications. The breach's scope highlighted systemic risks to historical data retention practices, as decades-old student records remained accessible on compromised systems. No evidence emerged publicly regarding confirmed misuse of stolen data or explicit ransom demands, but the incident necessitated institutional scrutiny of cybersecurity protocols for legacy data storage. Response efforts focused on stakeholder notification and preventive measures rather than detailed public disclosure of technical remediation steps.