Cyber Security Update

On June 12, 2026, Northern Marianas College (NMC) detected unauthorized access to its network and computing infrastructure. The College contained the activity the same afternoon and began its incident response process.

The College's investigation determined that the unauthorized actor obtained a level of access at which privileged student and employee information stored on the College's legacy systems was potentially accessible during the period of compromise.

The unauthorized access was contained on June 12, 2026, and the route through which it occurred has been terminated. College email systems and Student/Faculty/Employee online portals (including Portal+) were not part of the compromised systems and are safe to use.

The College advises all users to be aware and include safe security practices in all their online activities; including being aware of phishing attempts, practicing secure password management, enabling multi-factor authentication and having their devices regularly scanned for malware and viruses.

NMC discovered the unauthorized access at 3:33pm on June 12, 2026. At 4:10pm, 37 minutes after discovery, the affected systems were shut down and the College's incident response process began.

The incident was carried out by an unauthorized and unidentified actor from outside the College. Because the matter remains under investigation internally and with federal law enforcement, NMC is not able to share further details about the actor or the incident at this time.

There is no evidence that the incident was part of a ransomware attempt. No ransom was sought from the College, nor was any paid.

The unauthorized access was contained on June 12, 2026, and the route through which it occurred has been terminated. The investigation being done internally and by federal authorities into the incident remains ongoing, and the College continues to strengthen its security safeguards.

Following containment, the College's priority was to determine, through Digital Forensics and Incident Response (DFIR) analysis, what systems were involved, what information was potentially accessible and whether any information was removed. The College did this work internally and in coordination with federal law enforcement authorities. The College also wanted to make certain that its public notice was accurate and to give individuals clear steps they can take, rather than speculate.

NMC is working with federal authorities, including the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA). The College has also reported the incident to the Federal Trade Commission and to the U.S. Department of Education's Office of Federal Student Aid.

The types of information that were potentially accessible include, but are not limited to: full names; email addresses and phone numbers; student identification numbers; social security numbers; dates of birth; academic records, including enrollment history, grades and transcripts; banking information; financial aid records, including award amounts and disbursement data; home addresses and contact information; and parent or guardian information associated with financial aid applications. Institutional employee information, including information regarding employment, financial and personal information were also potentially accessible.

Based on an extensive investigation, including digital forensic analysis, the College believes that no information was lost or stolen. However, because the actor held elevated privileges during the unauthorized access, the College cannot state with absolute certainty that no information was compromised, stolen or lost. NMC is providing this notice out of an abundance of caution. Continuing investigations within the College and its federal partners may yield additional information which the College will then notify the public through official channels.

It means that the level of access the unauthorized actor obtained would have allowed the information to be accessed. It does not mean that the information was viewed, copied, modified or removed. The College's investigation has not identified evidence that information was accessed in any way, but it cannot rule that possibility out entirely.

Institutional employee records, including but not limited to employment, financial and personally identifiable information were included among the data that was potentially accessible. The College believes that no information was lost or stolen. However, because the unauthorized actor held elevated privileges while the access was in progress, the College cannot state with absolute certainty that no information was compromised, stolen or lost.

The information involved was stored on the College's legacy systems, which hold records from prior years. Former students may therefore be included.

Parent or guardian information associated with financial aid applications is among the types of information that were potentially accessible. Parents and guardians may follow the same protective steps described on this page and may contact the College with any questions.

Colleges are required to retain certain student, academic and financial aid records for defined periods under federal and territorial requirements.

You may contact the College for cybersecurity matters, including this incident via the following official channels:

• Telephone: 670-237-6711
• Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

For more information you may also visit the NMC Cyber Security Update Portal at https://marianas.edu/cybersecurityupdate

The College can confirm whether your records were among those potentially accessible and which types of information were involved.

NMC has a webpage dedicated to providing updated information and informing the public of this incident at https://marianas.edu/cybersecurityupdate.

Communications from NMC about this incident will not ask you to provide your Social Security number, passwords or financial information.

If you receive a message that claims to be from NMC and asks for this information, do not respond to the message, click any links or open any attachments. Instead report it to This email address is being protected from spambots. You need JavaScript enabled to view it. or contact the College at 670-237-6711.

Do not respond to the message, click any links or open any attachments. Report it to This email address is being protected from spambots. You need JavaScript enabled to view it. and then delete it. Scammers sometimes use public notices such as this one to make their messages appear legitimate.

Reporting suspicious activity and messages will help the College to advance its investigation and warn others of the potential threat.

Although the College believes the risk of data loss is low, NMC encourages all past and current students and employees to review their financial account statements and credit reports for unusual activity, to remain alert to phishing messages, and to consider the additional protections described in this section.

You may obtain free credit reports from each of the three nationwide credit reporting agencies, Equifax, Experian and TransUnion, as often as once a week. Reports are available at www.annualcreditreport.com or by calling 1-877-322-8228. This is the only website authorized by federal law for free credit reports; be cautious of other sites that claim to offer them.

A fraud alert tells lenders to take extra steps to verify your identity before opening credit in your name. It is free and lasts one year, and you may renew it. If you notice suspicious activity or are concerned about identity theft, you may place a fraud alert by contacting any one of the three credit reporting agencies, which will notify the other two.

A security freeze restricts access to your credit report, which makes it more difficult for anyone to open new accounts in your name. Placing and lifting a freeze is free under federal law. A freeze must be placed with each of the three credit reporting agencies separately, and you will need to lift it temporarily when you apply for new credit. Whether to place a freeze is a personal decision; it may be appropriate if you notice suspicious activity.

• Equifax: 1-800-685-1111, www.equifax.com, P.O. Box 740241, Atlanta, GA 30374.
• Experian: 1-888-397-3742, www.experian.com, P.O. Box 9554, Allen, TX 75013.
• TransUnion: 1-888-909-8872, www.transunion.com, P.O. Box 2000, Chester, PA 19016.

Because Social Security numbers were among the information potentially accessible, you may wish to request an Identity Protection PIN (IP PIN) from the Internal Revenue Service. An IP PIN is a six-digit number that helps prevent anyone else from filing a federal tax return using your Social Security number. Any taxpayer who can verify their identity may request one at www.irs.gov/ippin.

Contact the bank, lender or company involved right away. You may also report identity theft to the Federal Trade Commission at www.identitytheft.gov or 1-877-438-4338, which will help you create a recovery plan, and you may file a report with law enforcement. If you believe the activity is related to this incident, please also contact the College through its official channels: by telephone at 670-237-6711 or by email at This email address is being protected from spambots. You need JavaScript enabled to view it.. You can also visit the NMC Cyber Security Update Portal at https://marianas.edu/cybersecurityupdate.

Suspicious activity that occurs after this incident is not necessarily the result of it, and fraud can arise from many unrelated sources. The College can confirm whether your records were among those potentially accessible and which types of information were involved, and will work with individuals on a case-by-case basis.

Changing your password periodically is good practice. Use a strong password that you do not use for any other account, and turn on 2-Step Verification for your NMC accounts if you have not already done so.

NMC has identified and terminated the means through which the unauthorized access occurred. The College is moving forward with additional network monitoring and intrusion detection capabilities, and is reviewing and strengthening its information security policies and technical safeguards.

Yes. NMC has reported the incident to the Federal Trade Commission, as required under federal financial institution data security regulations, and to the U.S. Department of Education's Office of Federal Student Aid. The College has also reported the incident to federal law enforcement and the Cybersecurity and Infrastructure Security Agency.

In addition to the measures described above, NMC is reviewing its information security policies and technical safeguards with the goal of strengthening the protection of student and employee information.

NMC will post updates on the NMC Cyber Security Update Portal, which can be viewed at: https://marianas.edu/cybersecurityupdate

Please contact 670-237-6711, available Monday through Friday, 9am-3pm (ChST), or write to This email address is being protected from spambots. You need JavaScript enabled to view it.. Additional information about protecting yourself from identity theft is available from the Federal Trade Commission at www.identitytheft.gov or 1-877-ID-THEFT (1-877-438-4338).