Cole Sowders & Cannon Russo
News Editor & Staff Writer

Clackamas Community College. Photo taken by Henry Gonzales.

Current and former students are suing Clackamas Community College after a data breach that occurred in September of 2025 which exposed sensitive personal information belonging to more than 33,000 people.

The lawsuits, including a proposed federal class-action case, allege the college failed to adequately protect confidential student and employee data after hackers gained unauthorized access to portions of the college’s network between Oct. 24 and Oct. 30, 2025. 

According to the court filings and public breach notices, the compromised data that was leaked would have included social security numbers, date of births, student records and financial account information.

One of the lead plaintiffs identified in the court filings is Aidan Zahn, who claims the college stored sensitive data in an “unencrypted, internet-accessible environment,” making it vulnerable to cybercriminals, according to the lawsuit.

Another lawsuit was filed by Emma Center in the U.S. District Court in Oregon. Plaintiffs argue the college acted negligently by failing to implement adequate cybersecurity safeguards and by waiting months to notify victims after discovering suspicious activity.

The college first detected suspicious activity tied to a user account on Sept. 10, 2025. The account was reset but investigators discovered additional unauthorized access on Oct. 24 of that year. 

CCC said it responded by containing parts of its network, launching an internal investigation and hiring outside cybersecurity specialists to conduct forensic analysis.

Investigators later determined hackers had accessed and copied files from a limited number of internal systems. CCC publicly disclosed the breach in Jan. 2026 and began notifying affected individuals by letter offering one year of free credit monitoring and identity protection services. 

According to state filings from the Maine Attorney General’s Office, approximately 33,381 people were affected nationwide. 

Cybersecurity researchers later linked Medusa who claimed to take credit for the attack in Oct. 2025, which allegedly demanded $300,000 in ransom and claimed to have roughly 1.2 terabytes of information from the college’s system.

Photo of the website from the Ransomware attackers Medusa. Photo provided from Comparitech.com

The lawsuits seek monetary damages and compensation for victims who now face increased risks of identity theft and fraud. Plaintiffs are also requesting reimbursement for out-of-pocket expenses related to credit monitoring and fraud prevention, along with court ordered improvements to the college’s cybersecurity systems. 

Zahn’s suit stated that he experienced a significant number of spam calls and suspicious communications following the breach. Court documents state the lawsuit could include at least 100 affected individuals. Attorneys representing the plaintiffs argue victims could “face long term risks because Social Security numbers and other permanent identifying information cannot be easily replaced once compromised.”

The breach has also renewed concerns surrounding cybersecurity protections at colleges and universities nationwide, where institutions often store large amounts of sensitive financial and academic data while relying on aging technology infrastructure.

Former Head of IT at CCC Saby Waraich said in April before he left his job at CCC that cyber threats at the college happen all the time. 

“Cyber threats are constant, even if most people on campus do not see them. We get attacked every single day, the challenge here is that folks don’t see it, so it seems like it’s invisible to them,” added Waraich. 

The 2025 breach was not the first cybersecurity incident involving the college. CCC also experienced a ransomware related attack in Jan. 2024 that temporarily shut down systems and exposed older student data primarily dating from 2013-2018.  

Representatives for the plaintiffs and CCC either declined to comment or did not respond to requests.. 

The lawsuits are currently moving through the courts. This story is currently ongoing and will be updated.