By Cole Sowders
Staff Writer

Clackamas Community College recently notified students and staff that personal information may have been accessed by an unauthorized third party following a cybersecurity incident discovered last fall.

Screenshot of letter notifying students. Screenshot from Maine Attorney General’s Office.

On Sept. 10, CCC identified suspicious activity tied to one of their user accounts and quickly reset the account.

Then one month later, on Oct. 24, the college received more suspicious activity. They worked to contain their network to prevent more of a widespread attack according to letters sent by the college.

President Tim Cook said “Looks like the information they got was from our internal drive. From what we can tell just by looking at that I drive it’s kind of a dumping ground.”

The college then worked with a forensic security firm to assist with their investigation to ensure the security of their computer network. Upon the investigation done with the assistance from the forensic security team, they determined that an unauthorized third party gained access to a small number of systems, according to the letter sent by the college.

Almost two months later, on Dec. 18, the college identified the list of the potentially acquired files. Of those that were affected, the files contained information with the student’s name, date of birth, social security number and any information related to student records, according to the letter.

“We are taking steps to reduce the risk of this type of incident occurring in the future, including enhancing our technical security measures,” the letter stated.

The cyber attack was the second to affect CCC students and staff in three years. The college shut down classes for a week in 2024 during a previous cyber attack. 

CCC’s IT department did not return emails asking to comment. When trying to reach Head of IT, Saby Waraich, for comments on the situation, automatic replies stated he is on extended leave and has been since fall term during the time of the investigation. 

Waraich later said the leave was unrelated to the cyberattack.

Saby Waraich headshot. Photo provided by Saby Waraich.

College administrators chose to not answer questions. 

“I can’t provide any specific information since it’s under investigation by a federal forensic firm and all specific information is protected by the insurance company paying for that forensic investigation,” said Jeff Shaffer, CCC’s Vice President of Operations.

“For example, when I asked our attorney what types of things we cannot release any information on, they said things we cannot talk about are things like: Who was impacted, how many people were impacted, what information did people have information to, what do we know about whether any information obtained by the threat actors, what security the college has in place or is making changes to prevent it from happening again, etc.” Shaffer wrote in an email. 

However, according to a data breach notification, submitted by CCC’s attorney, Pasha Sternberg, to the Maine Attorney General’s office, 33,381 people have been affected.

CCC offered to pay for one year of credit monitoring through the company IDX.

“IDX was chosen due to its solid reputation in this space, and we chose to engage them for this incident because they have a streamlined offering for notification, call center support, and identity theft protection and monitoring services that we believed would simplify the communication of the incident and help our community access all of the resources offered in one place,” said Lori Hall in an e-mail from Public Information Officer for CCC.  

Photo of Rendon during interview. Photo taken by Quinton Prudhomme.

CCC instructor Joel Rendon said, “If certain data is leaked, organizations are required by law to notify users of data being leaked.”

“A year is the minimum requirement, and that’s what a lot of companies and colleges offer,” said Rendon.

College administrators have been vocal in the past about needing to do more to protect against cyber attacks.

Waraich and former Vice President Alissa Mahar spoke with The Print in 2022 about the college’s cybersecurity budget.

The two of them had requested from the board of directors $2.8 million over three years for cybersecurity upgrades to the college’s program. “That’s with barely hitting the minimum of 3.9 that most universities have in place,” said Mahar.

Waraich stated, “Most organizations that have some level of sophistication do have a security program in place to protect systems and assets, as you can imagine, that’s something we’d like to do for CCC.”

“In the meantime Clackamas Community College will not be optimized. Even if the IT department gets the $2.8 million into the budget as requested, the college is only hitting the minimum standard over the next three years. Not exactly the most reassuring state to find one’s personal information in.” said Waraich.

Since 2022, the college’s budget for IT increased 22% from $4.5 million to about $5.5 million in 2025.