UC extends Experian subscription for those affected by 2020 data breach

This post was updated April 3 at 10:32 p.m.

The University of California recently extended the identity protection service subscription for an additional two years for victims of last year’s data breach as part of a broader effort to improve cybersecurity measures.

In December 2020, the University’s Accellion file transfer appliance experienced a cyberattack, according to the UC Office of the President.

The appliance transferred sensitive information such as full names, addresses, telephone numbers, Social Security numbers, financial information and other identifying data. Perpetrators targeted the appliance’s security vulnerabilities, affecting more than 100 organizations, including the UC and its faculty, staff and applicants, other universities, government agencies, and private companies across the county, according to UCOP’s notice of the data breach. The UC determined March 29, 2021, that some data was posted online.

The University then offered a free one-year subscription to Experian, an identity protection service, for possible victims of the breach. From May to June 2021, the UC contacted potentially impacted community members as its investigation continued.

[Related: Students discuss UC handling of personal information security after cyberattack]

The UC has undergone a large-scale effort to enhance cybersecurity measures and educate UC faculty, staff and students, said UCOP spokesperson Ryan King in an emailed statement.

According to a report presented at the UC Board of Regents meeting in March, UC campuses are still implementing policy changes. Campuses are also finding opportunities to formalize and improve their security management programs to ensure that key leadership understand their roles in overseeing cybersecurity.

King said the UC no longer uses the Accellion file transfer appliance and has shifted to a new vendor’s system with improved security controls.

“UC has deployed additional system monitoring broadly throughout its network and endpoints, conducted security health checks of systems that contain confidential data, and enhanced security controls, processes and procedures,” he said.

UCLA spokesperson Ricardo Vazquez said in an emailed statement that UCLA has been working with UCOP to address the breach’s root causes. UCLA shares data with UCOP, specifically through the UCPath payroll portal, he added.

Vazquez also said UCLA is developing a four-year security transformation roadmap for overall security.

“One of the cornerstones of this roadmap is the BruinSecure Initiative,” Vazquez said. “This initiative is focused on raising awareness and providing role-specific training around the expectations for security moving forward.”

Vazquez said UCLA held a live forum for community members to discuss ways to secure personal information as well as concerns about the data breach.

UCLA Strategic Communications, Information Technology Services, the Office of the Administrative Vice Chancellor, the Office of Legal Affairs, and the Office of the Chief Information Security Officer have supported efforts to improve data security, he added.

“We are working to revise the OCISO website and provide up-to-date information about current threats along with recommendations for members of the community to protect themselves in the face of those threats,” Vazquez said.