Notices and monitoring offers
Keep the complete Illinois Central College notice, envelope, email, enrollment instructions, deadline, and any later updates.
Investigation · Student & Employee Data
Illinois Central College Data Breach Investigation
Hall Attorneys is evaluating potential claims after reports that Illinois Central College student, employee, payroll, financial-aid, and banking records were obtained in a June 2026 extortion campaign.
- Affected-person count
- Not confirmed
- Public claim date
- June 15, 2026
- Claimed volume
- 28+ GB
file and email counts are not reliable person counts
date the extortion claim was reported
attacker claim; not an official college finding
Answer at a glance
What is known about the Illinois Central College breach?
Public threat-intelligence reporting says ShinyHunters named Illinois Central College in June 2026 and claimed to have obtained more than 28 GB across more than 122,000 files from PeopleSoft Campus Solutions and Human Resources and connected systems.
The claim describes employee payslips, pension payroll files, direct-deposit records, student financial-aid and grade-roster exports, enrollment files, and salary-allocation data. These details currently trace to the threat actor's claim and have not been confirmed in a detailed public college notice.
A third-party breach directory lists 220,233 unique email addresses, but that does not establish the number of distinct affected people or validate all claimed file contents. This page therefore treats the individual count and detailed scope as unconfirmed.
This is an investigation, not a filed lawsuit by Hall Attorneys. Facts may change as organizations, regulators, courts, or security researchers publish additional information.
PeopleSoft zero-day campaign disclosed
Oracle issued its CVE-2026-35273 alert, and Mandiant reported an active ShinyHunters campaign heavily concentrated in higher education.
Illinois Central College named
Threat-intelligence services recorded a ShinyHunters extortion claim concerning Illinois Central College and a deadline to negotiate before publication.
Third-party email index added
XposedOrNot added an entry listing 220,233 unique email addresses. That directory entry is not an official affected-person count.
Reported data categories
What information was involved?
The detailed categories below come from a reported attacker statement, not a completed Illinois Central College or regulator investigation. They should be treated as allegations unless confirmed for a particular person.
Important distinction
Claims about 28 GB, 122,000 files, and 220,233 unique email addresses measure different things. None establishes a reliable number of distinct affected students or employees.
- Employee records — alleged
- Payslips, salary allocations, pension payroll files, and Social Security numbers
- Banking data — alleged
- Direct-deposit records with bank-account and routing numbers
- Student records — alleged
- Financial-aid records, grade rosters, enrollment exports, and academic account data
- Contact and account data
- A third-party index describes names, usernames, email addresses, phone numbers, and birth dates
Who may want to contact us
Students, employees, and notice recipients
Because official individual scope remains unclear, the investigation is focused on people who receive notice and those with records matching the reported student or employee systems.
Current or former Illinois Central College students who receive an incident notice
Current or former employees whose payroll, pension, banking, or HR information may have been involved
Students whose financial-aid, enrollment, grade, or account information may have been involved
People experiencing ICC-themed phishing, payroll or aid fraud, identity theft, financial loss, monitoring costs, or lost time
What to preserve
Keep college, employment, payroll, and financial-aid records
Preserve relevant records, but do not send passwords, complete bank-account numbers, Social Security numbers, financial-aid records, tax forms, or government identification through ordinary website forms.
Relationship records
Preserve records showing your student, alumni, applicant, or employment relationship with Illinois Central College, including dated account, enrollment, employment, alumni, transaction, or correspondence records.
Information held about you
Save records or dated screenshots showing the contact, identity, academic, employment, financial, or profile information the organization held about you.
Suspicious communications
Keep phishing emails, texts, calls, password-reset messages, account alerts, or other communications that use organization-specific details.
Credit and account records
Preserve credit alerts, unfamiliar-account notices, fraud reports, freeze confirmations, monitoring results, and relevant financial correspondence.
Time, expenses, and harm
Track time spent securing accounts or responding to misuse, along with out-of-pocket costs, lost funds, denied credit, or other concrete effects.
Investigation focus
Issues under review
Hall Attorneys is reviewing whether the public claims are substantiated, what systems and records were actually involved, the college's notice process, and concrete harms.
- Whether the attacker claims concerning PeopleSoft and connected systems are accurate
- When access began and ended and when Illinois Central College detected or learned of the event
- How many distinct students, alumni, applicants, employees, retirees, or other people were affected
- Whether Social Security, banking, payroll, pension, financial-aid, grade, or enrollment information was actually acquired or published
- Whether affected people received complete and timely notice and protective services
- Whether the incident led to targeted phishing, payroll or aid fraud, identity theft, financial loss, monitoring costs, or time loss
Public records reviewed
Sources for the Illinois Central College incident
No detailed official college notice was located during this review. The page therefore distinguishes technical campaign reporting, threat-actor claims, and third-party email indexing.
Security Affairs ·
EdTech Faces a Cybersecurity Crisis: Data Breaches Surge
Contemporaneous reporting that names Illinois Central College among education-sector organizations claimed by ShinyHunters.
Read source: EdTech Faces a Cybersecurity Crisis: Data Breaches SurgeHookPhish ·
Ransomware Group ShinyHunters Hits: icc.edu
Reproduces the reported threat-actor claim concerning file volume, systems, and alleged student, employee, payroll, and banking records.
Read source: Ransomware Group ShinyHunters Hits: icc.eduXposedOrNot ·
IllinoisCentralCollege Data Breach
A third-party breach-directory entry listing 220,233 unique email addresses and several contact and account fields.
Read source: IllinoisCentralCollege Data BreachGoogle Threat Intelligence Group and Mandiant ·
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
Describes activity attributed to UNC6240, also known as ShinyHunters, observed from May 27 through June 9 and aligned with exploitation of CVE-2026-35273.
Read source: ShinyHunters Targets Education Sector with Oracle PeopleSoft ExploitOracle ·
Security Alert Advisory — CVE-2026-35273
Oracle says the PeopleSoft PeopleTools vulnerability is remotely exploitable without authentication, may allow remote code execution, and affects supported versions 8.61 and 8.62.
Read source: Security Alert Advisory — CVE-2026-35273Contact the firm
Did you receive an Illinois Central College breach notice?
Contact Hall Attorneys with your general student or employment relationship, whether you received notice, and a summary of suspicious activity or loss. Do not include passwords, bank details, Social Security numbers, financial-aid records, or identification documents in an initial message.
Frequently asked questions
Illinois Central College breach FAQ
Is this a filed Illinois Central College data breach lawsuit?
No. This page describes an investigation by Hall Attorneys and does not state that the firm has filed a lawsuit concerning Illinois Central College.
How many people were affected?
A reliable distinct-person count has not been confirmed. Public sources refer to more than 122,000 files and a third-party index of 220,233 unique email addresses, but those figures measure different things.
Did Illinois Central College confirm the claimed data?
The detailed public claims reviewed for this page originate with the threat actor and third-party reporting. A detailed official college notice confirming the full categories was not located.
What information was allegedly involved?
Reported claims describe student enrollment, financial-aid and grade records; employee payslips and salary data; pension payroll files; Social Security numbers; and direct-deposit bank and routing numbers.
Why does the page label the scope unconfirmed?
File volume, file count, and unique-email count cannot be converted reliably into a number of distinct affected people, and the detailed categories have not been confirmed in a completed public institutional review.
Attorney Advertising
Hall Attorneys is not affiliated with Illinois Central College or the publishers cited on this page. This page concerns an investigation, not a filed lawsuit by Hall Attorneys. Sending information does not create an attorney-client relationship. Do not send passwords, monitoring codes, complete financial-account numbers, government identification, or other highly confidential information unless specifically requested through a secure channel.