Was Houston City College Breached? We Scanned Their Domain Security

Yes — Houston City College (hccs.edu) was breached. The Houston community-college system now appears on Have I Been Pwned with about 831,642 unique email addresses from a June 2026 ShinyHunters “pay or leak” extortion campaign that later published student and alumni records.

HIBP added the breach on July 28, 2026. Published data includes names, email addresses, phone numbers, physical addresses, dates of birth, genders, citizenship statuses, and academic records for current students and alumni — per HIBP and reporting from GBHackers and Security Affairs.

We scanned hccs.edu and related campus hosts, probed website stack signals, checked lookalike domains, and reviewed HCC’s public MFA policy (YubiKey and Google Authenticator) against the 100% ideal for domain security.

What Happened

According to Have I Been Pwned and contemporaneous reporting:

• June 2026 — ShinyHunters named Houston City College among several higher-ed victims in a pay-or-leak campaign (Security Affairs, June 17, 2026).
• Stolen data was later published publicly after extortion demands were not met, according to secondary reporting.
• ~831.6k unique emails and associated student/alumni PII were indexed.
• July 28, 2026 — HIBP added the HoustonCityCollege breach.

Google threat intelligence reporting in June urged PeopleSoft-using campuses to harden after ShinyHunters education-sector activity — but public sources have not confirmed Houston City College’s exact initial-access method (GBHackers). HCC’s own student systems documentation still references a PeopleSoft Student Center, and campus MFA docs state MFA is not required for Canvas or the PeopleSoft student system (see MFA section below).

Breach Impact at a Glance

Data at Risk

Exposed records may include:

• Full names and email addresses
• Physical addresses and phone numbers
• Dates of birth, genders, and citizenship statuses
• Academic records

That mix is high-value for financial-aid phishing, identity theft, impersonation of advisors, and account-recovery fraud against @student.hccs.edu and personal mailboxes.

Independent Cybersecurity Audit

We ran an EmailMeNow Cybersecurity Audit on August 2, 2026. 100% is the ideal overall score.

my.hccs.edu is a student/faculty portal hostname — treat its 0% identity score as a reminder that portal hosts often lack the same DMARC/BIMI posture as the apex brand domain students recognize in their inbox.

Key findings:

• 68% overall on the primary brand domain — matches our Texas community-college scoreboard and still well below the 100% ideal for a campus holding student PII.
• 50% Identity & Spoofing — room remains for spoofed @hccs.edu / aid / registrar mail during an active leak window.
• 15% Transport Security — no effective MTA-STS enforcement (common Texas CC failure mode).
• 92% Website Security — public web hardening is comparatively strong; email identity/transport are the binding gaps.
• 100% Email Infrastructure — mail routes through enterprise filtering (Proofpoint / iphmx.com MX on hccs.edu and student.hccs.edu).

Texas community-college context

Fresh peer scores (same audit engine; ideal remains 100%):

HCC sits mid-pack: stronger website score than Dallas/ACC, weaker identity than San Jacinto, and the same 15% transport floor as most peers.

Audit links: hccs.edu · my.hccs.edu

MFA: YubiKey & Google Authenticator

Public policy from mfa.hccs.edu and the HCC Student MFA FAQ (rev. May 12, 2026):

How we grade: Fail = SMS/voice/email OTP as a documented second factor; Partial = app push / soft token without open TOTP or YubiKey; Pass = open TOTP; Strong = FIDO/YubiKey.

Reading the FAQ accurately: HCC does not say the word “banned,” but the answer to “Can I use Google Authenticator…?” is an explicit policy disallowance — No, only Microsoft Authenticator (plus SMS). That is stronger than “not advertised” or “schools prefer Microsoft.” Combined with an allowed SMS path, no YubiKey docs, and no MFA on Canvas / PeopleSoft, the Microsoft-login grade is Fail.

Website stack note

Passive website-tech probes on August 2, 2026 (hccs.edu, my.hccs.edu, eagleonline.hccs.edu, student.hccs.edu, pm.hccs.edu):

Stack fingerprinting does not prove the breach vector. It does show a classic community-college surface: CMS + Java auth + Canvas + PeopleSoft-adjacent student email.

Lookalike / cybersquat scan

Standard cybersquat probe of hccs.edu (77 variants): 15 registered lookalikes to review; 0 clearly pointing back at the HCC brand in this pass; 0 BEC-staging MX hits under the automated flag.

Students should treat unexpected “HCC aid,” “transcript,” or “refund” mail from non-hccs.edu hosts as hostile until verified in person or via published campus channels.

Priority Actions

If you are an HCC student or alumnus:

• Check Have I Been Pwned for your address.
• Assume academic and contact data may fuel phishing — verify aid, refund, and transcript requests through hccs.edu or the IT Service Desk (713-718-8800), not reply-to links.
• Prefer Microsoft Authenticator over SMS where you can; never approve unexpected MFA pushes (HCC MFA fatigue guidance).
• Place fraud alerts or credit freezes via IdentityTheft.gov if you see identity misuse.

For community-college IT:

• Close the PeopleSoft / Canvas MFA gap called out on mfa.hccs.edu — SIS without MFA is incompatible with today’s ShinyHunters education campaign tempo.
• Allow open TOTP (Google Authenticator / Proton Pass–class apps, not Microsoft-only) and document FIDO/YubiKey enrollment; stop treating SMS as a first-class second factor.
• Push hccs.edu identity from 50% → DMARC p=reject and transport from 15% → MTA-STS mode=enforce toward the 100% ideal.
• Inventory registered hccs.* TLD swaps (especially hccs.com) for defensive registration or monitoring.

Related Trackers

• Have I Been Pwned 2026 tracker
• Government & education breaches
• UTSA attempted unauthorized activity (not a confirmed breach)
• Top Texas community colleges email security
• Moody Bible Institute / ShinyHunters
• Infinite Campus / ShinyHunters
• University of St. Thomas–Houston breach
• MFA support directory

Protect student and alumni correspondence.

Run a free Instant Cybersecurity Audit at audit.emailmenow.com or contact EmailMeNow IT Consulting for DMARC enforcement, MTA-STS deployment, and incident-response planning.

Sources: HIBP — Houston City College · Security Affairs — EdTech ShinyHunters wave · GBHackers — 832k students/alumni · HCC MFA · HCC MFA FAQ · EmailMeNow audit — hccs.edu