Clackamas Community College Hit by Second Ransomware Attack in Two Years, Exposing 33,000 Individuals Clackamas Community College in Oregon has notified 33,381 individuals of a data breach discovered in October 2025, marking its second ransomware attack in two years. The compromised data includes names, Social Security numbers, student records, government and tax ID numbers, medical information, passport numbers, and financial account details. The ransomware group Medusa claimed responsibility for the attack on October 29, 2025, demanding a $300,000 ransom for 1.2 terabytes of stolen data. The gang posted sample documents as proof of the breach, though Clackamas has not verified the claim. It remains unclear whether the college paid the ransom or how the attackers gained access. According to Clackamas’ notice, suspicious activity was first detected on September 10, 2025, prompting an account reset. A second incident on October 24, 2025, led to a forensic investigation, which confirmed unauthorized access and data exfiltration on the same day. The college is offering affected individuals one year of free credit monitoring and identity theft protection through IDX. Medusa, a ransomware-as-a-service (RaaS) operation active since 2019, has been linked to 154 attacks in 2025 alone, with 32 publicly acknowledged by victims. The group’s average ransom demand is $529,000, and it has targeted multiple U.S. schools this year, including Laurens County School District 56 (SC), Fall River Public Schools (MA), and Franklin Pierce Schools (WA). Clackamas’ previous breach in January 2024, which exposed 8,797 individuals, was attributed to the LockBit ransomware group. Across the U.S., 49 confirmed ransomware attacks on educational institutions in 2025 have compromised over 3.8 million records, disrupting operations such as attendance tracking, grading, communications, and payroll. Some schools, including Oakland Community School District 5 (IL) and Pell City School System (AL), have refused to pay ransoms, risking prolonged downtime and data loss. Clackamas Community College serves approximately 20,000 students across its three Oregon campuses.

On March 2, 2025, the Maine Office of the Attorney General reported a data breach involving Klamath County School District. The breach, discovered on February 24, 2025, potentially affected personal information of one Maine resident, including their name, Social Security number, and financial account information. Affected individuals were notified on February 28, 2025, and identity theft protection services were offered.