Central Piedmont

A Ransomware Attack Shut Down North Carolina's Second-Largest College for Nearly Two Weeks

Wednesday, February 10, 2021NCinfrastructure failureadvisorymedium confidence

Confirmed Threat

Central Piedmont Community College's IT department discovered a ransomware attack on the evening of February 10, 2021, that shut down nearly all college operations — email, Blackboard and other systems — for almost two weeks. The college canceled classes, eliminated its scheduled spring break to make up lost instruction, and accelerated a planned migration to a new learning management system. Some classes resumed February 22, 2021.

Alerts: 3
Response: —
Killed: —
Injured: —

Institution

Central Piedmont Community College

Community College · NC

~40,000 students

Confirmed Timeline

Alert Sequence

3 messages in sequence

Some alert texts below are approximate reconstructions from news coverage, not confirmed verbatim transcripts. Reconstructed texts are shown in italic with a dashed border. Verified verbatim texts have a solid border and are marked accordingly.

INITIAL ALERTWebsiteLate on Wednesday, February 10, 2021, after IT detected the intrusion

Approximate reconstruction239 chars

Central Piedmont is currently closed due to technology interruptions affecting our systems. All classes are canceled and college services are unavailable. We are investigating and will provide updates as more information becomes available.

This text has been reconstructed from news coverage and may not reflect the exact original wording.

Reconstructed: the college's earliest public language referred to 'technology interruptions' before confirming a ransomware attack, matching the headline of the Central Piedmont Foundation alert page.

Email was among the downed systems, so the initial notice had to reach students through the website and social media rather than normal channels.

UPDATEWebsiteFriday, February 12, 2021, confirming the cause as a ransomware attack

Approximate reconstruction342 chars

Update: The technology interruptions affecting the college were caused by a ransomware attack. Central Piedmont remains closed and all classes are canceled while we work with cybersecurity experts and law enforcement to safely restore systems. We do not have a firm timeline for reopening. Please monitor this page and local news for updates.

This text has been reconstructed from news coverage and may not reflect the exact original wording.

Reconstructed: a Charlotte-Mecklenburg Police Department report and college statements confirmed the cause was a ransomware attack, and the college stayed closed Friday and through the weekend.

The explicit lack of a reopening timeline reflects how cyber-recovery differs from a weather closure with a known endpoint.

UPDATEWebsiteWeekend of February 20-21, 2021, ahead of a partial Monday return

Approximate reconstruction316 chars

Some classes will resume Monday, Feb. 22. To recover lost instructional time, the previously scheduled spring break is canceled. Many systems are still being restored, and you may not yet have access to email, Blackboard or other services. Faculty will communicate directly about how individual classes will proceed.

This text has been reconstructed from news coverage and may not reflect the exact original wording.

Reconstructed: EdNC reported some classes resumed February 22 and that the attack 'wiped out spring break' as the college tried to recover lost instructional time.

This is a partial-resumption notice, not an all-clear; weeks later some systems and data were still unrecovered.

Context

Background

Central Piedmont Community College, with campuses across Charlotte and roughly 40,000 students, is North Carolina's second-largest community college. On the evening of February 10, 2021, its IT department discovered something amiss in the school's systems, which turned out to be a ransomware attack that shut down nearly all day-to-day operations — including email and the Blackboard learning platform — for almost two weeks. The college canceled classes and, when some resumed February 22, eliminated its scheduled spring break to recover lost instruction, while also accelerating a planned migration to a new learning management system. EdScoop and QCNews reported the FBI and state investigators assisted, and WFAE found some systems and faculty data were still unrecovered weeks later. Because email and learning platforms were both offline, the college depended on its public website and social media to communicate the closure to tens of thousands of students.

Analysis

Key Findings

A ransomware attack closed North Carolina's second-largest community college for nearly two weeks

The college canceled its scheduled spring break to recover instructional time lost to the outage

Email and Blackboard were both down, forcing closure communication through the public website and social media

Some systems and faculty data remained unrecovered weeks after the attack, showing the long tail of cyber incidents

Outcome

Central Piedmont brought systems back over nearly two weeks, with some data and systems still unrecovered weeks later. State and federal investigators, including the FBI, assisted; the college did not publicly confirm whether a ransom was paid.

Provenance

Sources

News
Ransomware attack forces North Carolina college to cancel classes - EdScoop
edscoop.com
News
Some classes resume after cyberattack at Central Piedmont Community College - EdNC
ednc.org
News
CPCC remains closed Friday due to system-wide computer hack, CMPD report says - QCNews
qcnews.com
News
'Lost A Lifetime Of Work': Some CPCC Systems Still Not Recovered After February Cyberattack - WFAE
wfae.org

Alert Sequence

Background

Key Findings

Sources

Related Cases