Clackamas Community College faces class action lawsuit over October data breach

A class action lawsuit has been filed against Oregon-based Clackamas Community College for failing to secure students’ sensitive personal information that led to a data breach in late October.

 

Earlier in January, the community college announced that it suffered unauthorised access to its network in late 2025 that gave third parties access to students’ personal information stored in its servers. The college said it detected suspicious activity on two occasions between September and October and carried out an investigation with help from external cybersecurity experts to determine if the activity compromised stored information.

 

"After identifying the list of the potentially acquired files, we reviewed the files to determine if they contained personal information. Based on the results of our investigation, on December 18, 2025, we determined that the files contained for most individuals name, date of birth, Social Security number, and/or student record information," the college said.

 

"For a subset of individuals, the information could also include government identification number, tax identification number, medical information, passport number, and/or financial account information," it continued. "We are sending written notification letters to individuals whose information was included in the files. Individuals should refer to those notices regarding steps they can take to protect themselves, should they feel the need to do so."

 

Clackamas Community College, which received full accreditation in 1971 and offers programs and services in career technical, college transfer, literacy/basic skills, community education and business training, reported the incident to the Oregon Department of Justice on January 16, stating that the cyber security incident impacted 33,381 individuals. 

 

According to The Oregonian, a class action lawsuit has been filed against the community college in federal court in Portland, alleging that the college stored students’ names, dates of birth, tax identification numbers, passport numbers, financial accounts and health information in an unencrypted server that led to the significant data breach.

 

The suit, filed on behalf of more than a hundred impacted individuals by attorney Paul B. Barton, has demanded that Clackamas Community College pay compensation and punitive damages and offer free credit monitoring services for at least ten years to the affected people.

 

The class action suit has also accused the college of waiting until January to notify affected students and staff about the data breach, even though the college had determined the full extent of the breach in the middle of December.

 

This is not the first time that Clackamas Community College has suffered a data security incident involving students’ personal information. The college previously suffered a data breach on January 19, 2024, that gave third parties access to students’ data dated between 2013 and 2018. The college did not specify what data was impacted or how many students were affected by the incident.