{
  "id": "2022-07-05-college-of-the-desert-ransomware",
  "slug": "college-of-the-desert-ransomware-2022-07-05",
  "institution": {
    "name": "College of the Desert",
    "shortName": "COD",
    "state": "CA",
    "type": "community-college",
    "alertSystemName": "COD Emergency Alert",
    "enrollment": 12500
  },
  "incident": {
    "date": "2022-07-05",
    "endDate": "2022-08-05",
    "type": "infrastructure-failure",
    "cleryCategory": "advisory",
    "headline": "Infrastructure failure, July 5, 2022",
    "summary": "On July 5, 2022, [College of the Desert in Palm Desert, California was struck by a ransomware attack](https://www.insidehighered.com/quicktakes/2022/07/07/malware-attack-hits-college-desert) that took down its website, phone systems, email, and most online student services for nearly a month. The attack -- the second in two years at the community college -- prompted an FBI investigation and engagement of a third-party cybersecurity firm. [About 800 individuals ultimately had personal information potentially accessed without authorization](https://www.kesq.com/news/2023/03/02/college-of-the-desert-data-breach-possibly-compromised-800-people/), which was disclosed nearly nine months later in early March 2023.",
    "resolution": "confirmed-threat",
    "outcome": "COD worked with a third-party forensics firm and the FBI to restore systems over approximately four weeks. All online student services were restored by early August 2022. A data breach notification was issued in March 2023 for approximately 800 individuals whose personal information may have been accessed.",
    "casualties": {
      "killed": 0,
      "injured": 0
    }
  },
  "alerts": [
    {
      "sequence": 1,
      "type": "initial",
      "channel": "twitter-x",
      "verbatimText": "College of the Desert is experiencing a systemwide outage of most online services. Systems and programs such as Canvas, Adobe, and Microsoft Teams are available now. We are continuing to work to restore access as soon as possible. Please return here for updates. Thank you.",
      "isVerbatimConfirmed": true,
      "sourceDescription": "@CollegeofDesert on X (verbatim); the official post the cited Record article embeds as a twitter-tweet",
      "annotations": [
        "Lane B PRE-2024 flip 2026-10-14: the cited therecord.media article embeds the official @CollegeofDesert post as a twitter-tweet (status 1544379126915780611, 2022-07-05 17:54:11 UTC = 10:54 a.m. PDT). Two independent X API reads agree on the 273-char text; CDN syndication agrees. Replaced the 428-char news-reconstructed malware/FBI announcement (no evidenced full-message reproduction) with the official product. SPN not attempted (Lane A CLOSED); archiveUrl null.",
        "The confirmation that 'classes are not canceled' despite a near-total network outage was logistically challenging for a community college where many students depend on Canvas and email to access coursework.",
        "COD's public information officer Nicholas Robles referred to it as a 'malware attack' rather than ransomware, a distinction the college maintained for weeks."
      ],
      "characterCount": 273,
      "sourceUrl": "https://x.com/CollegeofDesert/status/1544379126915780611",
      "timestamp": "2022-07-05T10:54:11-07:00"
    },
    {
      "sequence": 2,
      "type": "update",
      "timestampApprox": "Mid-July 2022",
      "channel": "website",
      "verbatimText": "",
      "isVerbatimConfirmed": false,
      "sourceDescription": "Reconstructed from MeriTalk State & Local and Patch.com Palm Desert coverage of COD recovery updates",
      "annotations": []
    }
  ],
  "context": "The July 5, 2022 ransomware attack was the second time College of the Desert had been struck by malware in two years. [The first attack occurred in August 2020, when COD paid $1.1 million to regain access to its systems](https://kesq.com/news/i-team/2023/03/18/college-of-the-desert-paid-1-1m-to-hackers-in-2020-ransomware-attack-doing-more-now-to-cyber-safeguard-its-it-systems/) -- one of the largest ransomware payments by any community college in the US. The 2022 attack knocked out the college's website, email, landlines, and online student portal, serving roughly 12,500 students in the Coachella Valley. [The Record from Recorded Future News reported that the attack wiped out email, the public website, and landline phone service simultaneously](https://therecord.media/cyberattack-knocks-out-california-community-college-email-website-landlines), leaving staff without basic communication tools. The FBI investigated, and COD hired a third-party cybersecurity firm to manage remediation. All online student services were not fully restored for nearly a month. [In early March 2023, COD disclosed that the personal information of approximately 800 people may have been accessed without authorization during the July 2022 attack](https://kesq.com/news/2023/03/02/college-of-the-desert-data-breach-possibly-compromised-800-people/) -- a nine-month gap between attack and notification that drew criticism from privacy advocates. A separate, smaller malware incident also struck COD in April 2023, underscoring persistent cybersecurity challenges at the institution.",
  "keyFindings": [
    "Second ransomware attack in two years at COD; the 2020 attack had cost the college $1.1 million in ransom.",
    "Attack on July 5, 2022 took down website, email, phone, and online student services for nearly a month.",
    "Canvas, Adobe, and Microsoft Teams remained accessible via cloud; billing systems were offline and student fee deadlines were suspended.",
    "Data breach affecting approximately 800 individuals disclosed in March 2023, nine months after the attack.",
    "FBI investigated; a third-party cybersecurity forensics firm managed remediation."
  ],
  "sources": [
    {
      "title": "Malware Attack Hits College of the Desert -- Inside Higher Ed",
      "url": "https://www.insidehighered.com/quicktakes/2022/07/07/malware-attack-hits-college-desert",
      "type": "local-media"
    },
    {
      "title": "Cyberattack knocks out California community college email, website, landlines -- The Record",
      "url": "https://therecord.media/cyberattack-knocks-out-california-community-college-email-website-landlines",
      "type": "local-media"
    },
    {
      "title": "College of the Desert victimized once again by ransomware -- DataBreaches.net",
      "url": "https://databreaches.net/2022/07/05/ca-college-of-the-desert-victimized-once-again-by-ransomware-most-online-services-currently-down/",
      "type": "local-media"
    },
    {
      "title": "COD data breach possibly compromised 800 people -- KESQ",
      "url": "https://kesq.com/news/2023/03/02/college-of-the-desert-data-breach-possibly-compromised-800-people/",
      "type": "local-media"
    },
    {
      "title": "COD paid $1.1M to hackers in 2020 ransomware attack -- KESQ",
      "url": "https://kesq.com/news/i-team/2023/03/18/college-of-the-desert-paid-1-1m-to-hackers-in-2020-ransomware-attack-doing-more-now-to-cyber-safeguard-its-it-systems/",
      "type": "local-media"
    },
    {
      "title": "California College with 12,500 Students Knocked Offline -- SiliconAngle",
      "url": "https://siliconangle.com/2022/07/06/california-college-12500-students-knocked-offline-cyberattack/",
      "type": "local-media"
    },
    {
      "type": "official-social",
      "url": "https://x.com/CollegeofDesert/status/1544379126915780611",
      "title": "@CollegeofDesert status 1544379126915780611 (2022-07-05 systemwide outage notice)",
      "accessedDate": "2026-10-14"
    }
  ],
  "confidence": "high",
  "tags": [
    "ransomware",
    "malware",
    "community-college",
    "network-outage",
    "data-breach",
    "fbi",
    "california",
    "coachella-valley",
    "2022"
  ],
  "dateAdded": "2026-05-31",
  "lastUpdated": "2026-10-14",
  "addedBy": "ingestion"
}