HackingEducationHealthcareEducationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)PHIEmploymentEducationCriticalContained

University of California, Los Angeles

bd_80ef632ad1208b7d · schema v1 · pii pii-v1

Severity

Critical

Discovered

—

Filed

Jun 23, 2023

To disclose

—

Affected

290,000

Confidence

65%

Full breach record for University of California, Los Angeles →

UCLA reported unauthorized access to its network between May 28 and June 1, 2023. An unknown third party used valid credentials to access personal information of approximately 290,000 students, employees, and patients. Data exposed included names, addresses, SSNs, financial account numbers, and health records. UCLA engaged Experian to provide credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

May 28, 2023

Begins

Jun 23, 2023

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed290,000 affectedView incident

Name: University of California, Los Angeles
norm: university of california los angeles

Name: University of California, Los Angeles
norm: university of california los angeles
Industry: EducationllmHealthcarellm

Discovered: —
Breach occurred: May 28, 2023 – Jun 1, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 290,000nationwide
Data types: PIIIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)PHIEmploymentEducation
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the California Attorney General
Third party: via Experian
Initial access: valid_credentials

During the incident: Engaged Experian to provide credit monitoring and identity theft resolution services
Notified affected individuals
Notified the California Attorney General
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-568404
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 23, 2023
Raw hash: 6f0acdd987f794d448c95948c1bc6c894fae49b3d50b17b767cf58937f7c3241

Reporting entityUniversity of California, Los Angeles

Victim entityUniversity of California, Los Angeles

IncidentUnknown

Stated responseEngaged Experian to provide credit monitoring and identity theft resolution services

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov