On June 15, 2026, the shinyhunters ransomware group listed Illinois Central College on its leak site, announcing that more than 28 gigabytes of internal files had been exfiltrated from the community college’s systems. The data includes thousands of employee payslips, payroll records containing Social Security numbers, direct deposit banking details, student financial aid information, grade rosters, and enrollment records tied to @icc.edu email accounts. The group gave the college until 18 June 2026 to contact them or face full public release of the material.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch icc.edu
Get alerted the next time icc.edu files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about icc.edu’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates the compromised systems include PeopleSoft Campus Solutions, Human Resources modules, SURS pension reporting, Workday costing allocations, and ICCB curriculum databases. Available reporting describes 9,200 employee payslip PDFs, more than 500 SURS payroll files that list Social Security numbers, direct deposit bank account and routing numbers, student financial aid and grade roster exports, and enrollment CSVs. The stolen material spans payroll and academic records from 2021 through June 2026. The number of individuals directly affected remains unknown, but the volume and sensitivity of the files suggest current and former employees, students, and their families could be exposed.
Why This Matters for You and Your Family
If you or anyone in your household attended Illinois Central College, worked there, or received payments through its payroll or pension systems, your personal financial and academic information may now sit on a ransomware leak site. Social Security numbers, bank routing details, salary history, and student records are valuable to identity thieves who can open accounts, file fraudulent tax returns, or sell the information on underground markets. Children listed on family insurance or student accounts can also become targets. Once this type of data leaves institutional control, it can circulate for years, increasing the chance that someone in your family will face account takeovers or fraudulent charges.
The Doxxing and Identity-Chain Risks
Credential leaks like the @icc.edu email addresses in this incident often serve as starting points for larger doxxing chains. Public reporting shows that ransomware groups frequently publish samples to pressure victims, after which the full dataset moves to other criminals who automate identity mapping. This creates cascading risks: a stolen college record today can lead to a compromised gaming account tomorrow, especially for households where children use the same email domain or passwords.