SDCCD cyberattack disrupts four district colleges

Analyst assessment

DysruptionHub’s published report documented San Diego Miramar College’s May 4 statement that its IT team had identified and stopped a cyberattack and was restoring systems and websites. The college warned of intermittent service disruption while scans continued, and its public website was unavailable during DysruptionHub’s reporting.

Subsequent San Diego Community College District updates established that the event affected districtwide infrastructure rather than Miramar alone. The district said coordinated attempts to gain unauthorized network access began over the weekend, resumed after systems were briefly restored, and required a full network shutdown while IT personnel reviewed, rebuilt and scanned systems. Its restoration proceeded by college, included scans of approximately 5,500 devices districtwide, and culminated in districtwide network and service recovery.

SDCCD identifies four constituent colleges: San Diego City College, San Diego Mesa College, San Diego Miramar College and San Diego College of Continuing Education. Contemporaneous reporting also named all four within the affected district scope. DysruptionHub therefore assesses with high confidence that City, Mesa and Continuing Education experienced operational effects from the districtwide shutdown alongside Miramar, although only Miramar issued a separately reviewed campus attack notice and the public record does not provide a campus-by-campus inventory of compromised systems.

Operational significance

The district’s updates documented shutdowns affecting internet, campus Wi-Fi, transcript processing, websites, file servers and some campus operations. Times of San Diego reported that underlying applications supporting counseling, libraries, health appointments, food service and administrative offices were also affected. Classes generally continued, but some instructors canceled sessions, moved hybrid courses fully online from off campus, changed tests to in-person formats or relied on personal hotspots.

The incident occurred during final examinations and summer registration, increasing operational pressure on students and faculty across the district. Cloud-hosted services including mySDCCD and, initially, Canvas remained available, reducing the local disruption’s scope. The district explicitly said the separate May 7 Canvas incident was not part of this network intrusion.

Disclosure posture

Miramar publicly confirmed a contained cyberattack before the district issued detailed technical and operational updates. SDCCD later explained through its official update page that monitoring detected the intrusion, systems were taken offline to prevent external communication and potential data extraction, and some file structures and servers were rebuilt or re-imaged because the degree of infiltration created residual risk.

Times of San Diego reported that the district believed attackers entered through a vendor and attempted to exploit vulnerabilities in legacy systems. The district also said protected cloud data remained safe and that no student, employee or district data had been compromised. No later public breach notice or authoritative contradiction to that conclusion was identified.

Confidence and uncertainty

Confidence is high that malicious access occurred and that the containment response caused material disruption across SDCCD’s four colleges. That judgment is supported by Miramar’s direct confirmation, the district’s incident timeline, the districtwide device scan and restoration sequence, descriptions of attacker persistence, the full network shutdown, infrastructure rebuilding and independent reporting naming the constituent colleges.

The evidence is strongest for Miramar because the college issued its own notice, its website was unavailable, and the district said Miramar was the first college to receive restored network services. For City, Mesa and Continuing Education, confidence concerns operational impact from shared district infrastructure; the available evidence does not establish whether attackers accessed a college-specific system or device at each institution.

Current status

On May 13, SDCCD reported partial network restoration at Miramar and said access would be restored by college over the following days. By May 14, internet, Wi-Fi, file-server access and most websites were restored districtwide. The district’s May 15 status table marked internet, Wi-Fi, campus operations, transcripts and related services normal, supporting a resolved operational status.

Analytic gaps

The reviewed sources do not identify the vendor used for initial access, the precise exploited vulnerabilities, attacker identity, malware tooling, dwell time, affected accounts, persistence mechanisms or the specific file structures and servers rebuilt. They also do not provide a campus-by-campus inventory of affected or compromised systems, independently verify the district’s conclusion that no protected data was compromised, or establish ransomware, a ransom demand or extortion activity.