University of California universityofcalifornia.edu University of California data breach: what happened and what to do
In December 2020 attackers exploited a flaw in Accellion, a third-party file transfer tool, and reached University of California data. About 547,000 email addresses with names, dates of birth and Social Security numbers were exposed.
View all 13,115 breaches- Breach date
- 24 Dec 2020
- Affected
- 547,422
- Data exposed
- Dates of birth, Education levels, Email addresses, Ethnicities, Genders, Job titles, Names, Phone numbers, Physical addresses, Social security numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
The University of California (UC) disclosed in 2021 that attackers had reached its data through a third-party file transfer product called Accellion. Have I Been Pwned (HIBP) counts 547,422 affected accounts and dates the breach to December 24, 2020.
What happened
Accellion's file transfer appliance had a vulnerability, and many organizations used it to send large files. Attackers exploited the flaw in late December 2020. UC says it identified on March 29, 2021 that some of the stolen data had been posted online, and it emailed the UC community in early April. UC also said it had decommissioned the Accellion appliance and was moving to a more secure replacement.
What was exposed
HIBP's entry lists dates of birth, education levels, email addresses, ethnicities, genders, job titles, names, phone numbers, physical addresses and Social Security numbers. Press coverage of UC's notice says current and former employees and their dependents, retirees, current students and others in UC programs were affected, and that bank account numbers were involved for some people.
A name, date of birth and Social Security number together are what identity thieves need to open credit in your name. UC also said the people behind the attack sent mass emails threatening to publish data unless they were paid, which is a kind of scare tactic you should simply ignore.
UC's response
UC worked with outside cybersecurity experts, cooperated with the FBI and offered free credit monitoring and identity theft protection through Experian IdentityWorks to the whole UC community.
What to do if you were in it
- 1
Freeze your credit
Placing a freeze at Equifax, Experian and TransUnion is free and stops new credit being opened in your name. Lift it temporarily when you apply for credit yourself.
- 2
Watch your statements and credit reports
Look over bank and card statements for charges you don't recognize. You can pull free credit reports at annualcreditreport.com.
- 3
Take up the free monitoring
UC offered Experian IdentityWorks to its community. If you were a student or employee, check your UC notice for how to enroll.
- 4
Ignore extortion emails
Messages threatening to publish your data unless you pay are a pressure tactic. Don't reply or pay, and report them to your campus security office.
- 5
Expect phishing that mentions this breach
Criminals use leaked names and emails to write convincing messages. Don't click links in unexpected emails or texts, and go to the company's site by typing the address yourself.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks across breach databases and the dark web for your email and phone number and tells you what to do about each hit.
Frequently asked
Was I affected by the University of California breach?
UC said current and former employees, their dependents, retirees, current students and others in UC programs may be affected. Check any notice UC sent you, or contact the university.
What was exposed?
HIBP lists names, email addresses, dates of birth, Social Security numbers, phone numbers, addresses and other academic and job details.
How did the breach happen?
Attackers exploited a vulnerability in Accellion, a third-party file transfer product UC used.
Should I freeze my credit?
If your Social Security number may have been exposed, yes. A freeze is free at Equifax, Experian and TransUnion.
Sources
- Have I Been Pwned: UC
- haveibeenpwned.com/Breach/UC
- businesswire.com/news/home/20210510005214/en/UC-Notice-of-Data-Breach
- portswigger.net/daily-swig/university-of-california-data-breach-sensitive-information-of-staff-students-leaked
- nbcnews.com/news/us-news/university-california-victim-nationwide-hack-attack
Something wrong or out of date? Tell us and we'll re-check it.
