Merced College

Merced College, an educational institution in California, fell victim to a cybersecurity breach between October 25, 2022, and November 3, 2022, involving malware that compromised its systems. The incident led to the potential exposure of individuals' names and addresses, though no further details were disclosed regarding the extent of the data leak or whether additional sensitive information (e.g., financial records, Social Security numbers) was affected. The breach was officially reported to the California Office of the Attorney General on March 8, 2023, nearly four months after the initial intrusion. In response, the college offered identity monitoring services to impacted individuals as a mitigative measure. While the attack did not result in immediate financial fraud or systemic disruption, the exposure of personal identifiers poses risks of identity theft, phishing, or targeted scams for those affected. The delay in detection and reporting further highlights vulnerabilities in the institution’s cybersecurity posture, particularly in safeguarding student and staff data against evolving malware threats.

Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-564094

TPRM report: https://www.rankiteo.com/company/yosemite-community-college-district

"id": "yos342091725",
"linkid": "yosemite-community-college-district",
"type": "Breach",
"date": "10/2022",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'education',
                        'location': 'California, USA',
                        'name': 'Merced College',
                        'type': 'educational institution'}],
 'customer_advisories': 'identity monitoring services offered to affected '
                        'individuals',
 'data_breach': {'personally_identifiable_information': ['names', 'addresses'],
                 'sensitivity_of_data': 'moderate (names, addresses)',
                 'type_of_data_compromised': ['personally identifiable '
                                              'information (PII)']},
 'date_detected': '2022-10-25',
 'date_publicly_disclosed': '2023-03-08',
 'description': 'The California Office of the Attorney General reported that '
                'Merced College experienced a cybersecurity incident involving '
                'malware from October 25, 2022, to November 3, 2022, '
                "potentially exposing individuals' names and addresses. "
                'Affected individuals were offered identity monitoring '
                'services.',
 'impact': {'data_compromised': ['names', 'addresses'],
            'identity_theft_risk': 'potential (identity monitoring services '
                                   'offered)'},
 'references': [{'source': 'California Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': 'reported to the '
                                                       'California Office of '
                                                       'the Attorney General'},
 'response': {'communication_strategy': 'offered identity monitoring services '
                                        'to affected individuals'},
 'title': 'Merced College Malware Incident (2022)',
 'type': 'malware'}