Lakeland Community College, a public two-year institution in Kirtland, Ohio, began notifying 285,948 people in September 2023 that their personal information may have been accessed or acquired during an intrusion into its internal IT systems earlier in the year.
The college said an unknown, unauthorised party had access to certain internal systems between 7 March and 31 March 2023. The Vice Society ransomware group listed the college on its dark web leak site on 18 April 2023, within weeks of that window. The college did not name any group, confirm a ransomware attack or describe encryption of its systems. It engaged outside cybersecurity professionals, and the review that identified the affected individuals concluded on 20 August 2023. The college said it provided written notification commencing on or about 19 September 2023.
The information involved varied by individual. It included full names together with one or more of Social Security numbers, dates of birth, driver's licence or state identification numbers, financial account information, credit or debit card information, passport numbers, medical information and health insurance policy information.
The college offered a year of complimentary Equifax credit monitoring to people whose Social Security numbers were involved, and directed recipients to fraud alerts, credit freezes and state attorney general resources. It said it was not aware of any report of identity fraud or improper use of information as a direct result of the incident. Breach notices were filed with state attorneys general, including in Maine.