A Gulf Coast community college appeared on a ransomware leak-site tracker Wednesday afternoon. Ransomware.live indexed Coastal Alabama Community College (coastalalabama.edu) as a claimed victim of the Interlock ransomware group at 2026-10-21 19:29 UTC (about 3:29 p.m. ET Wednesday), with an estimated attack date of Oct. 21.
The college says on its own website that it has eight campuses serving communities across southern Alabama, with its main mailing address in Bay Minette, and that it has offered affordable education for more than 50 years. Its public site was up when we checked Thursday morning.
What's claimed, and what's confirmed
Claimed: Interlock's leak-site post says it is publishing student education records, protected health information, financial-aid and loan information, employee personnel files, Social Security numbers, and payment-card data. It also says the college violated HIPAA, FERPA, GLBA, and PCI DSS. Brandefense's ATLAS tracker records 34.88 MB of claimed data. All of that is an actor assertion. A leak-site post is not proof of what was taken, whether any systems were encrypted, or whether the files are what the group says they are. A group's legal conclusions about its own victim deserve the least weight of all.
Not confirmed: As of Thursday morning we found no statement from Coastal Alabama Community College, no news report confirming an incident, and no regulator or state notice. The college's news page showed nothing new since early October, and a Google News search for the college's name returned no incident coverage. The only reports we found came from tracker sites repeating the listing. There is no confirmed encryption, no confirmed theft of student or employee data, no reported disruption to classes or financial aid, and no word on any payment. Treat this as a claim until the college says otherwise.
What federal agencies say about Interlock
The FBI, CISA, HHS, and MS-ISAC published a joint #StopRansomware advisory on Interlock (AA25-203A) on July 22, 2025. It says the group was first seen in late September 2024, picks victims "based on opportunity," and is financially motivated. The FBI observed Interlock getting in through drive-by downloads from compromised legitimate websites, which the advisory calls "an uncommon method among ransomware groups," often disguised as fake Chrome, Edge, or security-software updates. It also uses the ClickFix trick, where a fake error message talks the user into pasting and running a command. Interlock runs a double-extortion model, stealing data and then encrypting systems, including virtual machines on Windows and Linux.
Why it matters to colleges, schools, and training programs
A community college holds the records that make fraud easy: student IDs and transcripts, financial-aid files, payroll for faculty and adjuncts, and health information from nursing, EMS, and athletic programs. Its users are also the kind Interlock's methods work on. Students and part-time instructors browse on shared lab computers and personal laptops, and a pop-up telling them to "fix" their browser looks routine.
The quickest harm after a listing is usually fraud, not encryption. Students, staff, and the local employers who hire them should expect emails or texts about "financial-aid holds," refund or direct-deposit changes, W-2 or payroll updates, and fake help-desk password resets. Schools, training centers, and employers across Alabama, Northwest Georgia, Atlanta, and Chattanooga should confirm any payment or deposit change through a number already on file.
Clear takeaway
Use Interlock's claim against Coastal Alabama Community College as a term-time drill for colleges, schools, and training programs. Block fake-update downloads, train staff and students on ClickFix prompts, require MFA on email and student systems, and keep a backup you can restore, whatever a leak site alleges.
Actions to take this week
- Turn on DNS filtering for campus and staff networks, as the advisory recommends, to block known-malicious sites before a fake update loads.
- Brief staff and students on ClickFix: no real website asks you to press Windows+R and paste a command. Report it to IT instead.
- Require MFA on email, VPN, the student information system, learning platform, and financial-aid and payroll systems, starting with administrators.
- Lock down direct-deposit changes. Require a call-back or in-person check before anyone changes where a refund or paycheck goes.
- Test a restore of student, payroll, and file-server data this month, with one copy kept offline or in a separate, segmented location.
- Write a one-page incident card: who leads, who calls your insurer and IT provider, and what the front office tells students, parents, and staff who call.
Brotherly Technology helps schools, training programs, and the employers that hire their graduates across Rome, Northwest Georgia, Atlanta, Chattanooga, Alabama, and the Southeast turn ransomware headlines into a short readiness review covering MFA, web filtering, backups, and payment-change controls. If you want a second set of eyes before the next claim lands, give us a call.
Sources:
- Ransomware.live: Coastal Alabama Community College / Interlock. Discovered 2026-10-21 19:29 UTC; est. attack date 2026-10-21; claim-level only.
- Brandefense ATLAS: Coastal Alabama Community College. Records 34.88 MB claimed and the group's post text; claim-level only.
- CISA, FBI, HHS, MS-ISAC: #StopRansomware: Interlock (AA25-203A), July 22, 2025.
- Coastal Alabama Community College: About Us. Context: eight campuses across southern Alabama. No incident acknowledgment cited here.