Skip to content
Campus Alert Archive
COD

Infrastructure failure, July 5, 2022

AI-generated · every claim is source-linked
CAinfrastructure failureadvisoryhigh confidence
Confirmed Threat

On July 5, 2022, College of the Desert in Palm Desert, California was struck by a ransomware attack that took down its website, phone systems, email, and most online student services for nearly a month. The attack -- the second in two years at the community college -- prompted an FBI investigation and engagement of a third-party cybersecurity firm. About 800 individuals ultimately had personal information potentially accessed without authorization, which was disclosed nearly nine months later in early March 2023.

Alerts
2
Response
—
Killed
0
Injured
0
Institution
College of the Desert
Community College · CA
All COD cases →
~12,500 studentsCOD Emergency Alert
Documented Timeline

Alert Sequence

2 messages in sequence · 1 verified verbatim

Confirmed wording is transcribed character-for-character from a primary source. Use Verify this quote under each message to open that source in a new tab and compare the text yourself.

Some messages in this sequence are documented (their existence, timing, and channel are sourced) but their exact wording is not preserved in the public record. Those entries appear as placeholders; only confirmed text is displayed.

INITIAL ALERTTwitter/X
Verified verbatim273 chars
College of the Desert is experiencing a systemwide outage of most online services. Systems and programs such as Canvas, Adobe, and Microsoft Teams are available now. We are continuing to work to restore access as soon as possible. Please return here for updates. Thank you.
Lane B PRE-2024 flip 2026-10-14: the cited therecord.media article embeds the official @CollegeofDesert post as a twitter-tweet (status 1544379126915780611, 2022-07-05 17:54:11 UTC = 10:54 a.m. PDT). Two independent X API reads agree on the 273-char text; CDN syndication agrees. Replaced the 428-char news-reconstructed malware/FBI announcement (no evidenced full-message reproduction) with the official product. SPN not attempted (Lane A CLOSED); archiveUrl null.
The confirmation that 'classes are not canceled' despite a near-total network outage was logistically challenging for a community college where many students depend on Canvas and email to access coursework.
COD's public information officer Nicholas Robles referred to it as a 'malware attack' rather than ransomware, a distinction the college maintained for weeks.
UPDATEWebsite
Wording not yet recovered

A message was sent at this point in the sequence; its exact wording has not yet been recovered from the official record, so no text is shown. This site never paraphrases or reconstructs alert wording. Markers like this one keep the emergency's true shape and become word-for-word messages as recovery reaches the source.

Message elements

How the first alert is built

To check this alert, an AI model read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.

College of the Desert is experiencing a systemwide outage of most online services. Systems and programs such as Canvas, Adobe, and Microsoft Teams are available now. We are continuing to work to restore access as soon as possible. Please return here for updates. Thank you.

  • Sourceabsent0/0

    Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.

    See all 25 individual reads

    Open to load the 25 reads.

  • Hazardabsent0/0

    What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.

    See all 25 individual reads

    Open to load the 25 reads.

  • Locationabsent0/0

    Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.

    See all 25 individual reads

    Open to load the 25 reads.

  • Guidanceabsent0/0

    The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.

    See all 25 individual reads

    Open to load the 25 reads.

  • Timeabsent0/0

    When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.

    See all 25 individual reads

    Open to load the 25 reads.

  • Impactabsent0/0

    What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.

    See all 25 individual reads

    Open to load the 25 reads.

Systematic AI judgments with visible reasoning, not human-validated codings.

About this analysis
Context

Background

The July 5, 2022 ransomware attack was the second time College of the Desert had been struck by malware in two years. The first attack occurred in August 2020, when COD paid $1.1 million to regain access to its systems -- one of the largest ransomware payments by any community college in the US. The 2022 attack knocked out the college's website, email, landlines, and online student portal, serving roughly 12,500 students in the Coachella Valley. The Record from Recorded Future News reported that the attack wiped out email, the public website, and landline phone service simultaneously, leaving staff without basic communication tools. The FBI investigated, and COD hired a third-party cybersecurity firm to manage remediation. All online student services were not fully restored for nearly a month. In early March 2023, COD disclosed that the personal information of approximately 800 people may have been accessed without authorization during the July 2022 attack -- a nine-month gap between attack and notification that drew criticism from privacy advocates. A separate, smaller malware incident also struck COD in April 2023, underscoring persistent cybersecurity challenges at the institution.
Analysis

Key Findings

Second ransomware attack in two years at COD; the 2020 attack had cost the college $1.1 million in ransom.
Attack on July 5, 2022 took down website, email, phone, and online student services for nearly a month.
Canvas, Adobe, and Microsoft Teams remained accessible via cloud; billing systems were offline and student fee deadlines were suspended.
Data breach affecting approximately 800 individuals disclosed in March 2023, nine months after the attack.
FBI investigated; a third-party cybersecurity forensics firm managed remediation.
Outcome
COD worked with a third-party forensics firm and the FBI to restore systems over approximately four weeks. All online student services were restored by early August 2022. A data breach notification was issued in March 2023 for approximately 800 individuals whose personal information may have been accessed.
Provenance

Sources

Every claim on this page is meant to be checkable. Open the links below (and the Verify this quote control under each confirmed alert) to read the original university, news, or archive page yourself. Hostnames are shown so you can see where you are going; archived copies survive when live pages move or disappear. See also our methodology.

  1. News
  2. News
  3. News
  4. News
  5. News
  6. News
  7. Social
Cite this case

Campus Alert Archive. "College of the Desert: Infrastructure failure, July 5, 2022." Incident of July 5, 2022. Added May 2026; last updated October 2026. https://campusalertarchive.com/case/college-of-the-desert-ransomware-2022-07-05/

Download case JSON

Alert text quoted on this page remains the work of the issuing institution; the archive is a secondary source.

Tags
ransomwaremalwarecommunity-collegenetwork-outagedata-breachfbicaliforniacoachella-valley2022
Added May 2026Updated October 2026Via ingestion