{
  "id": "2022-04-29-kellogg-community-college-ransomware",
  "slug": "kellogg-community-college-ransomware-2022-04-29",
  "institution": {
    "name": "Kellogg Community College",
    "shortName": "KCC",
    "state": "MI",
    "type": "community-college",
    "enrollment": 9000
  },
  "incident": {
    "date": "2022-04-29",
    "endDate": "2022-05-04",
    "type": "infrastructure-failure",
    "cleryCategory": "advisory",
    "headline": "Infrastructure failure, April 29, 2022",
    "summary": "Kellogg Community College began experiencing technology issues tied to a ransomware attack on Friday, April 29, 2022, and [closed all five of its campuses](https://daily.kellogg.edu/2022/05/02/kcc-systems-impacted-campuses-closed-due-to-ransomware-attack/) (Battle Creek, Hastings, Albion, the Regional Manufacturing Technology Center at Fort Custer, and Coldwater) affecting roughly 9,000 students. Classes and operations were suspended until the college could [confirm its systems were safe](https://wwmt.com/news/local/kellogg-community-college-students-return-class-ransomware-attack-information-technology-investigation-passwords-security), and students returned the following Wednesday. The attack struck at the end of the spring term.",
    "outcome": "KCC reopened campuses and resumed classes Wednesday, May 4, 2022, after independent advisors and third-party experts confirmed the systems were secure; the college required password resets. Reporting linked the BlackCat/ALPHV group to the attack, though KCC did not confirm attribution publicly.",
    "resolution": "confirmed-threat"
  },
  "alerts": [
    {
      "sequence": 1,
      "type": "initial",
      "timestampApprox": "Friday, April 29, 2022, as technology issues began across campuses",
      "channel": "website",
      "verbatimText": "",
      "isVerbatimConfirmed": false,
      "sourceDescription": "Reconstructed from WWMT and KCC Daily reporting on the Friday closure",
      "annotations": []
    },
    {
      "sequence": 2,
      "type": "update",
      "timestampApprox": "Monday, May 2, 2022 (KCC Daily Alerts post dated May 2, 2022; no send time shown)",
      "channel": "website",
      "verbatimText": "On Friday, April 29, we began experiencing technology issues that have been impacting our systems. As part of our investigation, we learned that those issues were related to a ransomware attack.\n\nWe have been working with our IRT experts to resolve this situation as quickly as possible. As we are investigating this incident, all campuses will remain closed until further notice, and we are canceling classes until we are able to reopen safely.\n\nWe are implementing security measures to prevent any further unauthorized access to our network – including a forced password reset for all students, faculty and staff. Additionally, as a precautionary measure, all campuses have been disconnected and our systems will remain offline until they are deemed secure by our IT experts.\n\nAs a result, our students and staff might experience delays accessing our services, including campus emails, online classes and resources.\n\nWe understand that our students might be concerned about this situation, especially as we are nearing the end of the semester and for many, exams are top of mind. We want to reassure our faculty and students that we will take any actions necessary for students to complete course work in a timely manner.\n\nWe are committed to working with our faculty to support our students, and sincerely apologize for the interruption this incident has caused.\n\nOur investigation is still in its early stages, and we will share updates as soon as we learn more.\nWe appreciate your patience and support in the meantime.",
      "isVerbatimConfirmed": true,
      "sourceUrl": "https://daily.kellogg.edu/2022/05/02/kcc-systems-impacted-campuses-closed-due-to-ransomware-attack/",
      "sourceDescription": "KCC Daily 'Alerts' post 'KCC systems impacted, campuses closed due to ransomware attack' (May 2, 2022)",
      "annotations": [
        "Reconstructed from the KCC Daily article, which dated the start of issues to April 29 and confirmed the ransomware attack and the closure of all five campuses.",
        "Lane B flip 2026-10-12: full text recovered from the official KCC Daily post filed under the Alerts category (sole category; not News Releases). It is a longer first-person notice than the prior reconstruction and does not mention independent advisors or third-party experts; it announces the forced password reset already on May 2."
      ],
      "characterCount": 1523
    },
    {
      "sequence": 3,
      "type": "update",
      "timestampApprox": "Tuesday, May 3, 2022, ahead of a Wednesday return",
      "channel": "website",
      "verbatimText": "",
      "isVerbatimConfirmed": false,
      "sourceDescription": "Reconstructed from WWMT reporting on the Wednesday return and password resets",
      "annotations": []
    }
  ],
  "context": "Kellogg Community College, a roughly 9,000-student two-year college based in Battle Creek, Michigan, began experiencing technology problems on Friday, April 29, 2022, that it later [confirmed were a ransomware attack](https://daily.kellogg.edu/2022/05/02/kcc-systems-impacted-campuses-closed-due-to-ransomware-attack/). The attack forced the closure of all five KCC campuses (in Battle Creek, Hastings, Albion, the Fort Custer Industrial Park, and Coldwater) and the cancellation of classes near the end of the spring term, according to [WOOD-TV](https://www.woodtv.com/news/calhoun-county/ransomware-attack-disrupts-end-of-kellogg-community-college-term/) and [The Record](https://therecord.media/kellogg-community-college-ransomware-michigan). Students returned Wednesday, May 4, after the college said [independent advisors and third-party experts confirmed its systems were secure](https://wwmt.com/news/local/kellogg-community-college-students-return-class-ransomware-attack-information-technology-investigation-passwords-security), and required password resets. Some reporting linked the [BlackCat/ALPHV ransomware group](https://www.idstrong.com/sentinel/ransomware-attack-causes-community-college-to-suspend-classes/) to the incident, though the college did not publicly confirm attribution. As with peer institutions, the attack closed physical campuses because the underlying systems that run classes were offline.",
  "keyFindings": [
    "A ransomware attack closed all five Kellogg Community College campuses near the end of the spring term",
    "Roughly 9,000 students were affected across Battle Creek, Hastings, Albion, Fort Custer and Coldwater",
    "The college tied reopening to a security confirmation rather than a fixed date and required mandatory password resets",
    "Reporting linked the BlackCat/ALPHV group to the attack, a prolific actor in higher-ed ransomware in 2022-2023"
  ],
  "sources": [
    {
      "title": "KCC systems impacted, campuses closed due to ransomware attack - KCC Daily",
      "url": "https://daily.kellogg.edu/2022/05/02/kcc-systems-impacted-campuses-closed-due-to-ransomware-attack/",
      "type": "official-archive"
    },
    {
      "title": "Ransomware attack disrupts end of Kellogg Community College term - WOOD-TV",
      "url": "https://www.woodtv.com/news/calhoun-county/ransomware-attack-disrupts-end-of-kellogg-community-college-term/",
      "type": "local-media"
    },
    {
      "title": "Classes resume at Michigan community college after ransomware attack - The Record",
      "url": "https://therecord.media/kellogg-community-college-ransomware-michigan",
      "type": "local-media"
    },
    {
      "title": "Kellogg Community College students return to class after ransomware attack - WWMT",
      "url": "https://wwmt.com/news/local/kellogg-community-college-students-return-class-ransomware-attack-information-technology-investigation-passwords-security",
      "type": "local-media"
    }
  ],
  "confidence": "high",
  "tags": [
    "cyberattack",
    "ransomware",
    "community-college",
    "michigan",
    "blackcat-alphv",
    "campus-closure",
    "advisory"
  ],
  "dateAdded": "2026-05-28",
  "lastUpdated": "2026-10-12",
  "addedBy": "ingestion"
}