Lansing Community College data breach: a February 2025 credential compromise, notified in June 2026

What happened at Lansing Community College?

On February 18, 2025 the college identified unauthorized access to certain systems in its network. It secured them with outside specialists and found that an unauthorized actor had got in with compromised credentials six days earlier. The letter does not say whose credentials they were, how they were obtained, or whether ransomware was involved. It says the college then investigated the scope and who was involved. It notified law enforcement and says it will notify regulators where the law requires.

California's record gives February 12, 2025 as the date of the breach. California's list shows the college's report arriving on June 5, 2026. The letter itself is undated in the filed sample.

Date	What happened	Source
About February 12, 2025	Unauthorized actor gets in with compromised credentials	Notice letter, California AG record
February 18, 2025	College identifies the unauthorized access	Notice letter
June 5, 2026	Report reaches California	California AG list
June 19, 2026	Notice sent, per Indiana	Indiana record

Why did it take 16 months to notify?

The letter does not say. It describes the work in between only as a further investigation of "the scope of the incident and the individuals whose information may have been involved". From discovery to the California report is 472 days, and to Indiana's notice date 486. Measured from the incident to the California filing, as the guide to how long organizations take to notify measures 46 California notices, it is 478 days; that guide's median for 2026 was 69 days. It also sets out what state laws say about timing. The state breach notification laws guide lists each state's deadline.

What information was involved?

It varied by person. The letter lists name, address, date of birth, Social Security number, driver's licence, "or other information provided to or maintained by Lansing Community College". Not everyone had every item. The college says it has no evidence that anyone's information was removed from its systems or misused. The letter is written to anyone whose information was present in the affected systems, without saying whether they are students, former students, staff or others.

How many people were affected by the Lansing Community College breach?

Indiana's report gives 174,307 people in total, with 581 in Indiana. The letter adds that approximately 30 Rhode Island residents were affected. The ranking of 2026 breaches by people affected shows where it falls. No Texas or Washington record for this incident was found on 10 November 2026.

Has Lansing Community College had a breach before?

Yes. California's list has an earlier Lansing Community College filing, with breach dates of December 25, 2022 and March 15, 2023, reported on June 30, 2023. That is a separate incident from the February 2025 one. This log has no entry for it.

What is Lansing Community College offering?

Twenty-four months of credit monitoring and identity protection at no cost, for eligible people. Enrolment is at privacysolutionsid.com, under "Activate Account", with the activation code printed in the letter and by the deadline it gives. Confirmation comes from noreply@privacysolutions.com. The guide to credit-monitoring offers compares this offer with others in this log.

Was my information in the Lansing Community College data breach?

If you received the letter, from a Secure Processing Center in Suwanee, Georgia, your information was in the affected systems. The college's assistance line is 866-659-7088, toll-free, Monday to Friday, 9:00 a.m. to 9:00 p.m. Eastern Time. Written questions go to Lansing Community College, 411 N. Grand Avenue, Attn: Risk Management, Lansing, MI 48933. The guide to school and education breach notices compares what other schools and colleges have told students and families.

What the notice leaves open

• Whose credentials were compromised and how.
• What the college was doing in the 16 months between discovery and the letters.
• Who the 174,307 people are: students, former students, staff or others.
• Whether ransomware or a demand was involved.