Analyst assessment
Hartwick College in Oneonta, New York, experienced a disruptive technology incident in October 2024, followed by a reported Chort ransomware claim and later data-breach notifications. The college’s Oct. 27 announcement canceled the next day’s classes and changed staff and student schedules. Its April 8, 2025 consumer notice subsequently acknowledged a data-security incident that may have included personal information. The reviewed evidence supports a cyber incident, while ransomware and Chort’s responsibility remain unconfirmed.
Operational significance
The college gave nonessential staff Oct. 28 off unless otherwise instructed, extended assignment deadlines and deferred preregistration to Nov. 4. Athletic practices were to continue as scheduled. These instructions establish disruption to instruction and academic administration without establishing a complete campus closure or loss of every service.
The specific failed systems were not identified in the announcement. It does not establish separate email, telephone, internet or learning-platform outages. Nov. 4 was the scheduled replacement registration date; it is not a verified date of network restoration or evidence that all services remained unavailable until then.
Confidence and uncertainty
Comparitech reported the Chort listing on Nov. 15 and included Hartwick in its Nov. 18 reporting. The exact-domain ransomware.live lead records databases and files allegedly held by the group, with a discovery timestamp of Nov. 17. Tracker discovery does not date the original post or intrusion, and the earlier reporter post shows that the claim was already public.
The Indiana attorney general’s May 2025 report lists 4,803 affected people, including 13 Indiana residents. The college’s Massachusetts notice offers identity-protection services but does not identify the affected data categories or confirm copying, encryption or misuse. Lists of documents needed to request a credit freeze are consumer instructions, not evidence that those documents were compromised.
Regulatory dates are inconsistent. Indiana lists Oct. 22 as the breach date and an anomalous April 2024 notification date. The indexed Maine filing lists an Oct. 25 breach and Oct. 26 discovery, while the college’s original letter is dated April 8, 2025. The exact intrusion period is therefore left undated. The later notifications do not establish a separate incident or continuing service outage.
Analytic gaps
The initial access method, affected systems, actual data acquisition, verified data categories, ransom demand or payment and complete restoration date remain unresolved. General claims about college cybersecurity weaknesses do not establish the cause of this incident.
Operational disruption is presumed resolved given the elapsed time, but no exact recovery date is assigned. Oct. 28 is the latest specific operational effect established by the reviewed primary announcement. Neither the later claim reporting nor the 2025 notification process extends that operational timeline.
